SwissKnife for MS Graph

SwissKnife for MS Graph 1.0.0 — "Work from tasks"

The release where the app stops being a Graph browser and starts being a tool

for the tickets you actually get.

The app is organised around tasks now

Every page opens as a grid of the jobs it can do, each with a one-line

explanation. No more toolbar buttons that hide four unrelated operations behind

a word like "Membership": Users went from 5 drawers to 15 tiles, Intune's single

"Actions" drawer became three (lock / retire / wipe) so the difference between

them is stated instead of implied by three red buttons side by side.

• Ctrl+K opens the task palette — ~60 jobs in plain language, searchable in

English and Russian by your own words ("канал", "same access", "пароль"), each

landing on the exact form that performs it.

• Forms open in place, next to a panel that spells out the Graph rules that

will bite you: a private channel only accepts existing team members, dynamic

and Exchange-managed groups cannot be changed through Graph, removing the last

license deletes the mailbox after ~30 days.

• A per-page view switch — Actions / Both / Data — decides whether the tiles

or the raw result pane leads. The table, JSON and tree views are unchanged;

they are just no longer the whole screen. The choice is remembered per page.

• Every write reports on its tile and stays there, instead of a toast that

disappears in five seconds. Clear result returns to the tiles.

Playbooks got the same treatment

Onboarding and offboarding are two tiles instead of two tabs, so the report of a

run no longer disappears when you look at the other flow. Fields are labelled

instead of relying on placeholders, the sign-in name autocompletes the tenant

domains, and the warnings that matter (license removal kills the mailbox,

wiping is irreversible, deleting takes the mailbox and OneDrive with it) appear

next to the form the moment you tick the option that causes them.

• Role profiles — save the licenses, groups, teams and channels of a role

under a name ("Support L1") and apply them to the next hire in one click.

Offboarding keeps its two built-in phase presets.

• Channels from several teams at once — the selection now accumulates across

teams instead of resetting each time you pick a different one.

Offboarding finishes the job

Two steps that used to be left to whoever noticed:

• Hand the groups and teams over. Give the leaver's owned groups a new owner

and drop the leaver — in that order, so nothing is ever left ownerless. Owned

applications and service principals are deliberately untouched.

• Cancel the meetings they organise. Future meetings with attendees are

cancelled with a notice ("the organizer has left the organization"); solo

appointments are simply deleted. Meetings they only attend belong to somebody

else and are left alone.

Both are options on the offboarding form, each reported as its own step.

One place for "what did this app do"

The local action log moved into Run history as a second tab, next to the

multi-step runs. Two journals in two different menu entries was one too many.

Access mirror

"Give Bell the same access Whitfield has" is one screen now. It reads both

people's groups, admin roles, teams, private and shared channels and licenses,

shows the difference, and copies only what the target is missing.

• Additive only — nothing is ever removed from the target.
• Private channels bring their team along automatically.
• Dynamic and Exchange-managed groups are reported as failed steps with the

reason, never silently skipped.

• Typed confirmation of the target before anything is granted; the whole run is

journalled and lands in the local audit log.

• The comparison shows what only the *target* has, too — you should know when

someone is carrying access nobody else has.

Audit that answers the question

"Why can this person not sign in?" is a tile: one user's sign-ins, failures

first, over a chosen window, with the Entra error behind each row. Directory

changes can be filtered by the person who made them. Previously both were a

fixed dump of the last 50 events.

Everything tells you what it is doing

Every long operation now says so: a spinner and a live line in the page header

(visible in all view modes), the current stage for multi-step scans ("Source ·

channels of Intermark Team (3/12)"), a cancel button, and buttons that refuse a

second click instead of failing with "an operation is already running".

The long-running pages speak the same language now

Offboarding, Cleanup, Bulk / CSV and Usage reports are tiles too, with their live

console and report in the data pane:

• Offboarding — "how much data does this person have?" and "copy their

OneDrive to another account" are separate tiles; the backup pool has its own.

Source and target are picked by name instead of typed.

• Cleanup — the version-history scan and the duplicate scan are two tiles

instead of a tab strip, each stating what it will do to your data.

• Bulk / CSV — three tiles, one per operation, instead of a dropdown; the

chosen tile decides which columns the CSV is validated against.

• Usage reports — five tiles named after the question they answer ("who eats

the OneDrive storage") rather than the Graph report id.

• Security review — a Conditional Access policy is shown as what it actually

does: who it applies to, who is excluded, which apps and client apps, what it

demands (MFA, a compliant device, or a block), and its risk levels. The raw

JSON is still there, folded away. Enterprise app consents keep their split

between delegated and application permissions, with the warning that the

latter act without any signed-in user.

Smaller things that were quietly wrong

• Licensing was the last page on the old two-pane layout and made you paste a

SKU GUID; licenses are now picked by product name with seats used/left.

• Bulk / CSV accepts license and group names — license and group

columns replace skuId and groupId, resolved once before the run so a typo

fails immediately instead of after twenty half-applied rows.

• BitLocker keys are fetched per device instead of dumping the tenant's keys.
• Files can act on an item straight from a listing ("Use this ID").
• Reports say what they truncate ("Showing 200 of 4,318 rows…"), and their

names and periods are translated.

• Dashboard numbers are clickable.
• A Graph collection that came back empty could crash the page it landed on —

a Go service returning a nil slice marshals to null, and the first .map()

over it threw. Every list response is normalised to an array now.

• Cleanup no longer fails with 400 Request_BadRequest on a UPN containing

an apostrophe, a leading $ or the guest #EXT# marker — deep drive paths are

built from the object id.

• Hundreds of hardcoded English strings in Teams, Chats, Mail, Files, Intune,

Audit, Licensing and the shared pickers now go through i18n.

Upgrade notes

• No configuration changes. Profiles, secrets and the run journal are untouched.
• The mirror feature needs no new Graph permissions beyond what the copied kinds

already require (GroupMember.ReadWrite.All, TeamMember.ReadWrite.All,

ChannelMember.ReadWrite.All, RoleManagement.ReadWrite.Directory,

User.ReadWrite.All).

• Ownership transfer needs Group.ReadWrite.All; cancelling meetings needs

Calendars.ReadWrite. Both steps are opt-in on the offboarding form.

• The Activity menu entry is gone — the same log is the second tab of Run

history.

• Filtered sign-in queries need AuditLog.Read.All, as before.

🗡️ v0.9.0 — Foundation

The biggest release yet: operations became observable, cancellable, bilingual

and restart-proof — and the app learned to talk to your team.

🔔 Teams notifications

• Post a summary card to a Teams channel when a playbook finishes: who was

processed, backup destination, groups removed, failed steps in red.

• Plain webhook (Power Automate flow) — no extra Graph permissions, 2-minute

setup. Guide →

📼 Run history & resume

• Every playbook/transfer run is journaled to disk — restart the app, the

Run history page still shows every step and log line.

• A cloud copy interrupted by a reboot? Open History → Resume copy: items

finished in the cloud are re-attached, the queue continues, nothing repeats.

🧹 Offboarding to the end

• Intune devices: retire (remove company data) or wipe (factory reset)

every enrolled device of the departing user — one report step per device.

• MFA cleanup: phones, Authenticator, FIDO keys and TAPs removed

method-by-method.

• Registered Entra devices deleted so they don't linger in the directory.
• Shared-mailbox pre-flight: before removing licenses the playbook checks

the mailbox type and warns loudly if the mail would die in ~30 days.

💬 Teams chat backup *(preview)*

• Optional offboarding step: export all of the user's chats into a JSON archive

next to the OneDrive backup. Requires Microsoft-approved Chat.Read.All

(protected API) — the step explains exactly what to request until then.

🌍 Fully bilingual reports

• Playbook step reports now render entirely in the UI language (EN/RU),

including sizes, reasons and summaries.

🧭 UX

• Grouped sidebar (Identity / Collaboration / Devices / Data ops / Insights / System)
• Playbook presets, including the two-phase offboarding flow

(everything-except-licenses → convert to shared mailbox → licenses only)

• Backup target, forward-to and folder fields remember the last successful run
• Actionable errors: a 403 now tells you which Graph permission to grant;

Exchange-managed groups get a plain-language explanation

⬇️ In-app updates

• Update now in Settings downloads the installer and applies it silently.
• The installer migrates pre-0.8.0 installs (no more duplicate Apps entries) —

profiles and settings are preserved.

🔩 Under the hood

• Real cancellation: Cancel aborts in-flight requests, not just between files
• Graph throttling (429) honored on file streams; stalled transfers detected

by an idle watchdog instead of a blanket timeout that killed big files

• Structured errors across the app; concurrent operations no longer mix

their progress events

Full Changelog: https://github.com/Nemu-x/SwissKnife-for-MS-Graph/compare/v0.8.0...v0.9.0

⚡ OneDrive backup is now cloud-side (much faster)

• Offboarding backup now uses Graph server-side copy: files are copied

entirely inside Microsoft's cloud — bytes no longer transit your machine,

folders are copied recursively in a single async operation.

Real-world measure: a 4.7 GB / 936-file OneDrive went from hours to minutes.

• Automatic fallback to the previous download/upload path if the cloud copy

cannot start; re-runs skip items that already exist in the target.

▶️ Live playbook progress

• The Steps panel now streams in real time: every step shows a spinner

while running and a ✓/✗ with details when done.

• The backup step shows the scanned volume up front ("936 files · 4.7 GB")

and live overall progress ("1.9 GB / 4.7 GB — 41%").

• New Cancel button stops the run after the current step.
• Playbook state now lives in the app store: you can switch pages during a

run and come back — steps, progress and the final report survive; the

completion toast arrives even from another page.

🛡️ Safer offboarding

• Warning next to Remove all licenses: without a license the mailbox is

permanently deleted after ~30 days — convert the user to a shared mailbox

first to keep mail.

• Warning next to Delete user about mailbox/OneDrive loss.

💾 Nothing lost on navigation

• One-time secrets (Temporary Access Pass, freshly created app client

secrets) are kept until you explicitly close them.

• Heavy results (usage reports, expiring-credentials scan, service-principal

permissions) are cached and restored when you return to the page.

📦 Windows installer (NSIS)

• English + Russian installer UI, installs to

Program Files\Nemu-x\SwissKnife for MS Graph.

• Desktop-shortcut component, "launch now" checkbox, running instance is

stopped automatically before upgrade.

• Uninstaller keeps your data by default; removing profiles, secrets, audit

log and UI settings is an explicit opt-in.

• Executable renamed to SwissKnifeGraph.exe.

❤️ Support

• New "Support the project" card in Settings with crypto donation addresses.

Fixes & internals

• Graph async-operation polling hardened (transient network errors tolerated,

waiting status no longer treated as failure, 2-hour per-item cap).

• Wrapped Graph errors are now recognized by 403/404 helpers.
• All backend events are safe in headless runs (tests/CI).
• New tests: server-side copy (no local transit), playbook cancel, backup steps.

> Upgrade note: v0.7.0 installed to a different folder with its own

> uninstaller entry, so installing v0.8.0 does not remove it. Please

> uninstall the old version manually (Apps → "swissknife-app") — your

> profiles, secrets and settings are stored per-user and are not affected.

> The next release will handle this migration automatically.

Full Changelog: https://github.com/Nemu-x/SwissKnife-for-MS-Graph/compare/v0.7.0...v0.8.0

✨ Highlights

🚪 Offboarding — all the way

The Offboard playbook now covers the full checklist, not just the basics. New optional steps, each reported individually:

• 📧 Auto-reply (OOF) — permanent out-of-office with a custom or default message
• ↪️ Mail forwarding — server-side inbox rule to a colleague (survives sign-in block)
• 🙈 Hide from address lists (GAL)
• 📅 Calendar hand-off — read access for the manager
• 👥 Remove from all groups — one report line per group; dynamic/distribution groups fail gracefully

Full sequence: block sign-in → revoke sessions → OOF → forwarding → GAL → calendar → OneDrive backup → groups → licenses → (optional) delete.

📄 Bulk / CSV runner

A new page for mass operations driven by a CSV file: create users, assign licenses, add to groups. Column-validated preview, downloadable templates, sequential execution with live progress, cancel between rows, and a per-row success/failure report.

🚀 Onboarding accelerators

• 🎫 Temporary Access Pass — issue a TAP with configurable lifetime and one-time use; shown once with a QR code for easy phone entry during MFA setup
• 🌍 Guest invitations (B2B) — invite external users via /invitations, with optional invitation email

🛡️ Security review (read-only)

A new page for tenant audits:

• Conditional Access — all policies with On / Off / Report-only state and full JSON definitions
• Enterprise apps — per-app delegated grants (admin vs user consent, scopes) and application permissions

🔑 App secret rotation

One click to issue a new client secret on an app registration (complements the existing expiry monitor). The secret is shown once — copy it or lose it, exactly like the portal.

🧹 Cleanup got elastic

• Multi-select files with Select all and trim version history in bulk with a single typed confirmation
• Scan results persist after trimming — no more full re-scan after every action
• Live progress, cancel support, per-file failure reporting

📦 Packaging

• 🪟 Windows: installer + portable for x64 and ARM64 (the NSIS installer is back — it was silently missing in v0.6.0)
• 🍎 macOS: proper DMG for Apple Silicon and Intel with drag-to-Applications layout, install notes, and a one-click Gatekeeper quarantine fix
• 🐧 Linux: AppImage, deb, rpm, tar.gz for x64 and ARM64
• 🔏 SHA256SUMS.txt signed with minisign, as before

🧪 Quality

• 30 Go tests against a fake Graph server (offboarding order & safety, version-trim logic, request bodies, guards)
• Frontend unit tests + an EN↔RU locale-parity gate
• Playwright GUI smoke over the real production bundle
• Optional read-only smoke suite against a live test tenant
• golangci-lint; the release pipeline now refuses to publish without its core artifacts

🔧 Fixes

• About shows the real version (release tag in CI builds, x.y.z-dev locally); the update checker no longer claims a dev build is "the latest version"
• Landing page: real app icon instead of an emoji; download buttons only for assets that actually exist in the latest release
• GitHub Pages & AUR publishing now trigger automatically after each release

⚠️ New Graph permissions

The new features need additional Application permissions (+ admin consent): MailboxSettings.ReadWrite, Mail.ReadWrite, Calendars.ReadWrite, GroupMember.ReadWrite.All, UserAuthenticationMethod.ReadWrite.All, User.Invite.All, Application.ReadWrite.All, Policy.Read.All. See the Permissions wiki page for the per-feature matrix.

Full Changelog: https://github.com/Nemu-x/SwissKnife-for-MS-Graph/compare/v0.6.0...v0.7.0

Microsoft Graph desktop client for IT admins. Windows · macOS · Linux.

Highlights⭐

• Cleanup — reclaim space: find duplicate files & version-history bloat across OneDrive/SharePoint, trim old versions or delete extras; optional per-site size scan sorts biggest sites first.
• Live job console: offboarding copy & cleanup scans stream a timestamped log, survive leaving/returning to the page, and can be cancelled mid-run.
• Offboarding reworked: two-pane live log + report; copy to a target user or an auto-picked backup pool (by free space).
• Pick-by-name everywhere: users, groups, teams, channels, sites, roles, devices, chats in searchable pickers.

Security 🔒

Secrets in the OS keychain, token stays in the Go backend, every destructive action needs typed confirmation + local audit log.

Also in this line

Dashboard, Playbooks, user lifecycle, MFA reset & roles, licensing, Teams/Groups/Chats, mail send-as, Files, Devices + BitLocker, Intune, app-secret expiry, usage reports, service health, raw Graph playground. Bilingual EN/RU, dark/light, read-only mode, in-app update check.

Full Changelog: https://github.com/Nemu-x/SwissKnife-for-MS-Graph/compare/0.5...v0.6.0