SwissKnife for MS Graph 2.0.0 — “The execution layer”h1

2.0 turns SwissKnife from a Graph client with good forms into an administration runtime. Every change — whether it goes through Microsoft Graph, the Exchange Admin API, Exchange or Teams PowerShell, or on-premises LDAP — is now an action: it is previewed first, confirmed once, applied, journaled and audited the same way, in the app and on the command line. On top of that engine come the Exchange and Teams PowerShell tasks that Graph cannot do, incident response, configuration as code with restore, on-prem Active Directory, a remote PowerShell worker for Mac and Linux, and action packs you can install from the new Action Hub.

Highlightsh2

One engine for every changeh3

Preview → confirm → apply. Each action lists exactly what will change (before → after, per object) before anything is written. Destructive actions need the target retyped; nothing runs from a stale preview.
Several backends per action, picked at run time. An Exchange task uses the Exchange Admin API when the tenant has it, PowerShell on this computer otherwise, or the paired worker. Settings → Capabilities shows, for every action, what it runs through right now and why the alternatives can’t.
Same actions on the command line. SwissKnifeGraph action list and SwissKnifeGraph action run … use the same engine, preview and audit.
Journal and audit record every applied change with its backend.

Exchange and Teams PowerShell as buttonsh3

Full Access, Send As, Send on behalf, calendar and folder permissions, convert to shared, forwarding, email addresses, meeting-room processing, distribution list membership, transport rules, Teams meeting/messaging/calling/app policies for users and groups. PowerShell 7 and the ExchangeOnlineManagement and MicrosoftTeams modules install from inside the app (hash- and signature-checked).

Incident responseh3

Find and purge a phishing message tenant-wide (Graph eDiscovery), audit and disable suspicious inbox rules, block senders, review and release quarantine, report threats, reset MFA methods and passwords, and a one-click compromised-account playbook (compromised on the CLI).

Reports and Intune explorerh3

Inactive users, license waste, MFA status, guests, privileged roles, mailbox sizes and forwarding; what Intune assigns to whom, unassigned policies and assignment conflicts. Graph reports can run across several app-only tenant profiles at once.

Configuration as code — snapshot, diff, drift, restoreh3

Snapshots of Conditional Access, named locations, authentication policies, roles, licenses, groups, app registrations (no secrets), Intune configuration and compliance policies with their assignments, Exchange organization settings and transport rules, Teams meeting policies. Export to a git folder, diff two snapshots, watch for drift — and restore:

any section back to a snapshot, with a per-object preview of what differs;
everything since the snapshot in one preview, grouped by section, in an order that works (named locations before the policies that use them);
deleted Conditional Access and Intune policies are recreated (Intune with their assignments and non-compliance actions), Teams meeting policies too.

On-premises Active Directoryh3

Find users, disable/enable, unlock, reset passwords (LDAPS/StartTLS only) and manage group membership over LDAP — next to Microsoft 365 or on its own. Pick what you administer (Microsoft 365, on-prem, or both) and the menu follows.

Remote workerh3

A paired Windows machine runs the Exchange and Teams PowerShell for a Mac or Linux box. Pairing uses a one-time code and pinned mutual TLS 1.3; tokens are sent per call and kept only in the worker’s memory. Settings shows whether the worker is online, when it last answered and which modules it has.

Action packs and the Action Hubh3

Workflow packs chain built-in actions — no code. One preview, one confirmation; every step keeps its own permissions and profile limits.
Script packs add PowerShell actions, sandboxed: a script may call only the commands its pack declares, runs in ConstrainedLanguage, in its own process, never on the worker. Commands that reach the network or files are pointed out before you trust a pack.
Action Hub (Settings → Action packs): browse and install community packs — security, HR, Exchange, Teams, Intune, reports. Hub packs are signed with the project’s pack key (built in; pack.pub in the Hub repository, separate from the release key) and install as Signed; anything else runs only after you review and trust its exact files.
Ten packs at launch: security basics, phishing response, HR lifecycle, mailbox delegation, Teams governance, Intune rollout, license and list moves, litigation hold, Exchange audit reports and Teams policy audit.

Profiles for shared and junior useh3

Connection profiles can be read-only, limited to writes, or limited to members of chosen groups (tenant-wide changes and pack scripts are then refused up front). Partner (GDAP) profiles connect to customer tenants.

Interfaceh3

A collapsible icon sidebar, hiding pages you don’t use, a support card, and links to the project on GitHub and Telegram in Settings.

Security and reliabilityh2

A pre-release audit closed the following before 2.0:

The in-app updater verifies what it runs. The installer is checked against SHA256SUMS.txt signed with the release key, and hashed again right before it starts elevated; Windows ARM64 gets the ARM64 installer.
The access token stays on Microsoft Graph. Absolute URLs, paging links and redirects must stay on the Graph host over HTTPS; the Raw playground’s writes (including $batch and action endpoints such as device wipe) need a profile that allows destructive changes.
Tokens stay out of PowerShell logs where the app controls it (requests are parsed without cmdlets; the connect cmdlets themselves are still logged when an organisation turns on Module Logging for those modules).
A content security policy for the app’s pages; Graph-supplied links open only when they are https and outside the app.
PowerShell 7 install on macOS checks Microsoft’s package signature (team id included) on a root-owned copy; the installer accepts PowerShell 7 and later and gives up on a stalled download.
The CLI never takes a password on the command line (it reads it from stdin).
No more hangs: a delegated sign-in that has to be renewed asks you to sign in again (anywhere in the app) instead of waiting minutes for an invisible code; previews have a deadline and a Cancel button; one stuck PowerShell module no longer blocks the others.
Switching tenants is clean: connecting another profile fully disconnects the previous one first, and is refused while a long operation is still running.
Snapshots mark sections cut at 5,000 objects instead of reporting false drift; the audit log rotates; certificate profiles warn 30 days before the certificate expires; a damaged packs.json or worker pairing file is set aside and reported, never silently reset.
The Exchange Admin API retries “server busy” answers and falls back to PowerShell when an endpoint changes; interrupted, resumable copies survive journal clean-up; old update installers are cleaned up.

Upgrading from 1.xh2

Settings, profiles and secrets are kept.
Take a new snapshot before relying on restore: snapshots from 1.x do not record the tenant id or Intune non-compliance actions, and are refused or restored with defaults.
Action packs are new; there is nothing to migrate.

Known limitationsh2

The Exchange Admin API is in preview at Microsoft; actions fall back to PowerShell when it is not available.
Windows and macOS builds are not code-signed yet — verify downloads with the signed SHA256SUMS.txt (see the README).
winget: the package is awaiting its first approval in winget-pkgs.
Teams chat backup still waits for Microsoft’s protected-API approval for Chat.Read.All.

Full changelog: https://github.com/Nemu-x/SwissKnife-for-MS-Graph/compare/v1.1.0…v2.0.0

Downloads and full notes on GitHub: v2.0.0