SwissKnife for MS Graph 1.1.0 — “Where did the email go”h1

The first release after the task-first rewrite. Exchange Web Services starts being disabled on 1 October 2026 and the Reporting Web Service behind Get-MessageTrace is already deprecated, so this release leans into what Graph now offers on the mail side, finishes the offboarding story, adds a command-line mode, and prepares the app for the package managers you already use.

Highlightsh2

Message trace — “Where did this email go?”h3

A new tile on the Audit page next to “why can this person not sign in?”. Give a sender, a recipient, or both (external addresses are fine), a window of up to 10 days within the last 90, and you get the delivery status of every matching message; pick a row to see its hops through Exchange Online (delivered, quarantined, filtered, failed, pending). Uses the Graph v1.0 endpoint /admin/exchange/tracing/messageTraces that replaces the Reporting Web Service cmdlets.

The endpoint has a prerequisite the docs do not make obvious: the tenant needs a service principal for Microsoft’s Transport Data Platform application, otherwise Graph rejects the call even with the permission consented. The app checks for it and offers to create it (one-time write, Application.ReadWrite.All for that single click). It can take a few hours to become effective on Microsoft’s side, and the tile says so.

Mailbox copy in offboardingh3

Offboarding gains Copy a leaver’s mailbox to someone else, also available as a step of the offboarding playbook. The leaver’s mail folders (optionally contacts and calendar items) are recreated under a folder inside the target user’s mailbox through the mailbox import/export Graph APIs (GA May 2026), item by item in full fidelity, with a preview of the scope, a live cancellable log and a report of failed items. The playbook runs it right after the OneDrive backup and before license removal, because the mailbox dies with the license.

It does not replace converting the mailbox to shared (Graph still has no API for that) and it does not produce a PST. Microsoft positions these APIs for migration, and that is what this is: the mail lands in a colleague’s mailbox without keeping a licensed account around.

Entra recommendationsh3

Security → What Entra recommends fixing lists Microsoft’s own daily analysis of the tenant (per-user MFA to convert, stale apps and credentials, legacy migrations, Identity Secure Score items) as facts: priority, status, why it applies, the action steps with their portal links, and the impacted resources on click. Read-only. The API is still served from /beta, and the Identity Protection and Secure Score items appear only on Entra ID P2 tenants.

Tenant configuration snapshot & drifth3

Security → Snapshot tenant configuration saves Conditional Access policies, named locations, admin roles with their members, the authorization and authentication-method policies, licenses, domains, groups and app registrations (with credential expiry) into one local JSON file. What changed since the last snapshot? compares two snapshots and lists what was added, removed or changed, field by field — for a change-control record, or to find out what a colleague clicked last Friday. Sections the app is not allowed to read are skipped and marked, never fatal.

Command-line modeh3

The same binary runs headless when started with arguments: same profiles, same audit log and journal, no window.

SwissKnifeGraph get '/users?$select=displayName' --all --json
SwissKnifeGraph user alice@contoso.com
SwissKnifeGraph signins alice@contoso.com --failed --days 3
SwissKnifeGraph offboard alice@contoso.com --confirm alice@contoso.com --block --revoke --hide-gal

--profile picks a saved profile (optional when there is one), --json gives machine-readable output, --read-only blocks writes. Offboarding steps stream live to stderr. Exit codes: 0 ok, 1 failed, 2 usage error. On Windows the output goes to the console that launched it. See the Command line wiki page.

Package managersh3

Manifests for winget (Nemu-x.SwissKnifeGraph), Scoop (swissknife-graph) and a Homebrew cask ship in packaging/, and the release workflow updates winget automatically once the first submission is accepted. Arch users keep yay -S swissknife-graph-bin. Direct downloads and the minisign-signed checksums are unchanged.

Self-contained AppImageh3

The Linux AppImage now bundles GTK, WebKitGTK and its helper processes, so it runs on any distro with glibc 2.35 or newer without installing webkit2gtk-4.1 first (the 1.0.0 AppImage needed it from the system). It is built on Ubuntu 22.04 and smoke-tested in CI on a machine without WebKit. The asset is renamed to SwissKnifeGraph-x86_64.AppImage / SwissKnifeGraph-aarch64.AppImage (AppImage convention: no “linux” in the name); the deb, rpm and tar.gz keep their names and their distro dependencies.

In-app updater fixed on Windowsh3

Update now on 1.0.0 downloaded the installer and then failed with “The requested operation requires elevation”: the installer is per-machine and the app could not raise a UAC prompt. It now launches the installer through the shell with the runas verb, so one UAC dialog appears (the button says so beforehand). A declined prompt is reported as such and the button stays usable; any other failure offers to show the downloaded installer so you can run it by hand.

Notesh2

New permissions (all optional; only for the features you use): ExchangeMessageTrace.Read.All for message trace, plus Application.ReadWrite.All once, only to create the Transport Data Platform service principal; MailboxFolder.ReadWrite.All, MailboxItem.Read.All and MailboxItem.ImportExport.All (application permissions; to limit them to specific mailboxes use an Exchange RBAC for Applications role with a management scope instead of the tenant-wide consent) for the mailbox copy; DirectoryRecommendations.Read.All for recommendations; Policy.Read.All, RoleManagement.Read.Directory, Directory.Read.All and Application.Read.All for the configuration snapshot. The Permissions wiki page has the full matrix.
No configuration changes. Profiles, secrets, presets and the run journal are untouched. Snapshots are stored next to them in the app data folder.
The release workflow can sign Windows builds with Azure Trusted Signing and sign and notarize macOS builds when the corresponding secrets are set; this release is still unsigned on both, so the DMG keeps the quarantine fix and Windows ARM64 builds remain best-effort.
Chat.Read.All for the Teams chat backup step is still a protected API; the step stays blocked until Microsoft approves your app id.

Downloads and full notes on GitHub: v1.1.0