SwissKnife for MS Graph 1.0.0 — “Work from tasks”h1

The release where the app stops being a Graph browser and starts being a tool for the tickets you actually get.

The app is organised around tasks nowh2

Every page opens as a grid of the jobs it can do, each with a one-line explanation. No more toolbar buttons that hide four unrelated operations behind a word like “Membership”: Users went from 5 drawers to 15 tiles, Intune’s single “Actions” drawer became three (lock / retire / wipe) so the difference between them is stated instead of implied by three red buttons side by side.

Ctrl+K opens the task palette — ~60 jobs in plain language, searchable in English and Russian by your own words (“канал”, “same access”, “пароль”), each landing on the exact form that performs it.
Forms open in place, next to a panel that spells out the Graph rules that will bite you: a private channel only accepts existing team members, dynamic and Exchange-managed groups cannot be changed through Graph, removing the last license deletes the mailbox after ~30 days.
A per-page view switch — Actions / Both / Data — decides whether the tiles or the raw result pane leads. The table, JSON and tree views are unchanged; they are just no longer the whole screen. The choice is remembered per page.
Every write reports on its tile and stays there, instead of a toast that disappears in five seconds. Clear result returns to the tiles.

Playbooks got the same treatmenth2

Onboarding and offboarding are two tiles instead of two tabs, so the report of a run no longer disappears when you look at the other flow. Fields are labelled instead of relying on placeholders, the sign-in name autocompletes the tenant domains, and the warnings that matter (license removal kills the mailbox, wiping is irreversible, deleting takes the mailbox and OneDrive with it) appear next to the form the moment you tick the option that causes them.

Role profiles — save the licenses, groups, teams and channels of a role under a name (“Support L1”) and apply them to the next hire in one click. Offboarding keeps its two built-in phase presets.
Channels from several teams at once — the selection now accumulates across teams instead of resetting each time you pick a different one.

Offboarding finishes the jobh2

Two steps that used to be left to whoever noticed:

Hand the groups and teams over. Give the leaver’s owned groups a new owner and drop the leaver — in that order, so nothing is ever left ownerless. Owned applications and service principals are deliberately untouched.
Cancel the meetings they organise. Future meetings with attendees are cancelled with a notice (“the organizer has left the organization”); solo appointments are simply deleted. Meetings they only attend belong to somebody else and are left alone.

Both are options on the offboarding form, each reported as its own step.

One place for “what did this app do”h2

The local action log moved into Run history as a second tab, next to the multi-step runs. Two journals in two different menu entries was one too many.

Access mirrorh2

“Give Bell the same access Whitfield has” is one screen now. It reads both people’s groups, admin roles, teams, private and shared channels and licenses, shows the difference, and copies only what the target is missing.

Additive only — nothing is ever removed from the target.
Private channels bring their team along automatically.
Dynamic and Exchange-managed groups are reported as failed steps with the reason, never silently skipped.
Typed confirmation of the target before anything is granted; the whole run is journalled and lands in the local audit log.
The comparison shows what only the target has, too — you should know when someone is carrying access nobody else has.

Audit that answers the questionh2

“Why can this person not sign in?” is a tile: one user’s sign-ins, failures first, over a chosen window, with the Entra error behind each row. Directory changes can be filtered by the person who made them. Previously both were a fixed dump of the last 50 events.

Everything tells you what it is doingh2

Every long operation now says so: a spinner and a live line in the page header (visible in all view modes), the current stage for multi-step scans (“Source · channels of Intermark Team (3/12)”), a cancel button, and buttons that refuse a second click instead of failing with “an operation is already running”.

The long-running pages speak the same language nowh2

Offboarding, Cleanup, Bulk / CSV and Usage reports are tiles too, with their live console and report in the data pane:

Offboarding — “how much data does this person have?” and “copy their OneDrive to another account” are separate tiles; the backup pool has its own. Source and target are picked by name instead of typed.
Cleanup — the version-history scan and the duplicate scan are two tiles instead of a tab strip, each stating what it will do to your data.
Bulk / CSV — three tiles, one per operation, instead of a dropdown; the chosen tile decides which columns the CSV is validated against.
Usage reports — five tiles named after the question they answer (“who eats the OneDrive storage”) rather than the Graph report id.
Security review — a Conditional Access policy is shown as what it actually does: who it applies to, who is excluded, which apps and client apps, what it demands (MFA, a compliant device, or a block), and its risk levels. The raw JSON is still there, folded away. Enterprise app consents keep their split between delegated and application permissions, with the warning that the latter act without any signed-in user.

Smaller things that were quietly wrongh2

Licensing was the last page on the old two-pane layout and made you paste a SKU GUID; licenses are now picked by product name with seats used/left.
Bulk / CSV accepts license and group names — license and group columns replace skuId and groupId, resolved once before the run so a typo fails immediately instead of after twenty half-applied rows.
BitLocker keys are fetched per device instead of dumping the tenant’s keys.
Files can act on an item straight from a listing (“Use this ID”).
Reports say what they truncate (“Showing 200 of 4,318 rows…”), and their names and periods are translated.
Dashboard numbers are clickable.
A Graph collection that came back empty could crash the page it landed on — a Go service returning a nil slice marshals to null, and the first .map() over it threw. Every list response is normalised to an array now.
Cleanup no longer fails with 400 Request_BadRequest on a UPN containing an apostrophe, a leading $ or the guest #EXT# marker — deep drive paths are built from the object id.
Hundreds of hardcoded English strings in Teams, Chats, Mail, Files, Intune, Audit, Licensing and the shared pickers now go through i18n.

Upgrade notesh2

No configuration changes. Profiles, secrets and the run journal are untouched.
The mirror feature needs no new Graph permissions beyond what the copied kinds already require (GroupMember.ReadWrite.All, TeamMember.ReadWrite.All, ChannelMember.ReadWrite.All, RoleManagement.ReadWrite.Directory, User.ReadWrite.All).
Ownership transfer needs Group.ReadWrite.All; cancelling meetings needs Calendars.ReadWrite. Both steps are opt-in on the offboarding form.
The Activity menu entry is gone — the same log is the second tab of Run history.
Filtered sign-in queries need AuditLog.Read.All, as before.

Downloads and full notes on GitHub: v1.0.0