v4.0: Convert to PowerShell module with new features (#120)

* Fix hardcoded Graph URLs, add error handling, and clean up docs (#115)

- Replace 6 hardcoded graph.microsoft.com URLs with $script:GraphEndpoint
  in Get-AssignmentFailures to fix USGov/USGovDoD tenant support
- Add try/catch error handling to Get-GroupMemberships matching the
  pattern from Get-TransitiveGroupMembership
- Remove ghost .PARAMETER ShowAdminTemplates from comment-based help
- Add missing v3.10.0 release notes entry

Fixes #115

* Remove deprecated groupPolicyConfigurations and migrate deviceStatuses API (#117)

- Remove Administrative Templates (groupPolicyConfigurations) from all 9
  feature areas -- migrated policies already appear under Settings Catalog
  via configurationPolicies
- Remove AdminTemplates from html-export.ps1 chart and categories
- Migrate deviceConfigurations deviceStatuses endpoint (removed May 2024)
  to POST-based getConfigurationPolicyDevicesReport reporting API
- Update totalCategories counter from 17 to 16

Fixes #117

* Add v4.0 features: group simulation, policy search, UI improvements

- Add Option 12: Simulate Group Membership Impact (what-if add to group)
- Add Option 14: Simulate Removing User from Group (what-if remove)
- Add Option 15: Search Policy Assignments (reverse lookup by name)
- Add terminal-width-aware separators via Get-Separator helper
- Add UPN format validation before network calls
- Normalize y/n prompts to accept Y/y/Yes/yes
- Add Autopilot Deployment Profiles and ESP Profiles to simulation
- Add ScopeTagFilter support to simulation options
- Add dedicated -SimulateTargetGroup and -SimulateRemoveTargetGroup params
- Remove deprecated groupPolicyConfigurations policy type
- Fix hardcoded Graph URLs to use dynamic GraphEndpoint variable
- Bump version to 4.0.0

* Convert to PowerShell module with setting search feature

Convert the 11K-line monolith script into a proper PowerShell module
publishable to PSGallery via Install-Module.

Module structure:
- 18 exported cmdlets (Public/) for all features
- 30 private helper functions (Private/)
- Pre-cached SettingDefinitions.json (17,785 definitions)
- IntuneAssignmentChecker alias for interactive mode

New features:
- Search-IntuneSetting: search for specific settings across all
  Settings Catalog and Endpoint Security policies with configured values
- Update-IntuneSettingDefinition: refresh the settings catalog from Graph
- All options available as standalone cmdlets (e.g., Get-IntuneUserAssignment)
- PSGallery version check (replaces GitHub self-update)

Architecture:
- Module manifest (.psd1) with proper metadata and dependencies
- Module loader (.psm1) dot-sources Public/ and Private/ functions
- Module-scoped variables for shared state (GraphEndpoint, etc.)
- html-export.ps1 bundled locally (no more GitHub download)

* Update CI workflows for PowerShell module

- Add publish-module.yml: uses Publish-Module instead of Publish-Script,
  validates module loads before publishing
- Update psscriptanalyzer.yml: scan Module/ directory recursively instead
  of single script file
- Old publish-script.yml kept for reference (can be removed after v4.0 ships)

* Improve setting search with abbreviation expansion and fuzzy matching

- Add abbreviation map for common Intune terms (PSSO -> Platform SSO,
  WHFB -> Windows Hello for Business, LAPS, ASR, EDR, etc.)
- Add normalized matching (strips spaces/separators for fuzzy ID matching)
- Search now matches against both original keyword and expanded form
- Default to showing only configured settings (-ShowAll for everything)
- Widen policy name column to 80 chars to avoid truncation
- Fix progress line overwrite artifact on shorter policy names

* Fix app platform detection showing Multi-Platform for Windows apps

Windows app types without the literal 'windows' substring in their
@odata.type (win32LobApp, winGetApp, microsoftStoreForBusinessApp,
officeSuiteApp) fell through to 'Multi-Platform' in the HTML report.
Adds explicit mappings and returns 'Web App' for webApp.

Closes #121

* Archive v3 script and align release notes for v4.0 module

- Move legacy IntuneAssignmentChecker.ps1 and html-export.ps1 to old/v3/
  to match existing old/v1, old/v2 pattern and prevent users from running
  the outdated monolith after switching to the module.
- Delete publish-script.yml workflow (replaced by publish-module.yml;
  the old workflow would fail on release since Publish-Script cannot
  republish a path-moved script).
- Correct release notes menu option numbers (13/14/15 were misnumbered
  as 14/15/16) and mention the app platform detection fix.

* Rewrite README for v4.0 PowerShell module

- Replace .\IntuneAssignmentChecker.ps1 CLI examples with cmdlet usage
  (Get-IntuneUserAssignment, Connect-IntuneAssignmentChecker, etc.).
- Update parameter reference table to list the 18 exported cmdlets and
  their common parameters instead of old script switches.
- Document the four new v4.0 menu options (12-15): group simulations,
  policy search, and setting search.
- Fix System Options section: [T] Switch Tenant, [0] Exit, [98]/[99].
- Update Azure Automation runbook example to use Connect-* and New-* flow.
- Add migration note for users upgrading from the v3.x Install-Script.
- Remove the legacy 'Download and run the script' manual install path;
  replace with a local clone + Import-Module example.

* Bump 'Last updated' banner date to 2026-04-14

Author: ugurkocde

.github/workflows/psscriptanalyzer.yml

@@ -43,12 +43,12 @@ jobs:
           $infoCount = 0
 
           Write-Host "============================================"
-          Write-Host "Running PSScriptAnalyzer on IntuneAssignmentChecker.ps1"
+          Write-Host "Running PSScriptAnalyzer on Module files"
           Write-Host "============================================"
           Write-Host ""
 
-          # Run the analysis
-          $results = Invoke-ScriptAnalyzer -Path ./IntuneAssignmentChecker.ps1 -Settings ./.PSScriptAnalyzerSettings.psd1 -RecurseCustomRulePath
+          # Run the analysis on the module directory (all .ps1 and .psm1 files)
+          $results = Invoke-ScriptAnalyzer -Path ./Module/IntuneAssignmentChecker -Recurse -Settings ./.PSScriptAnalyzerSettings.psd1 -RecurseCustomRulePath
 
           if ($results) {
               # Group by severity
@@ -151,7 +151,7 @@ jobs:
           $reportContent = @"
           # PSScriptAnalyzer Report
 
-          **Script:** IntuneAssignmentChecker.ps1
+          **Module:** IntuneAssignmentChecker
           **Date:** $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')
           **Analyzer Version:** $(Get-Module -Name PSScriptAnalyzer -ListAvailable | Select-Object -ExpandProperty Version)
 

.github/workflows/publish-module.yml

@@ -0,0 +1,28 @@
+name: Publish PowerShell Module
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+jobs:
+  test-and-publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Validate module loads
+        shell: pwsh
+        run: |
+          Import-Module ./Module/IntuneAssignmentChecker -Force -ErrorAction Stop
+          $commands = Get-Command -Module IntuneAssignmentChecker
+          Write-Host "Module loaded successfully with $($commands.Count) exported commands"
+          $commands | Sort-Object Name | ForEach-Object { Write-Host "  - $($_.Name)" }
+
+      - name: Publish to PowerShell Gallery
+        shell: pwsh
+        env:
+          PS_GALLERY_API_KEY: ${{ secrets.NUGET_KEY }}
+        run: |
+          Publish-Module -Path ./Module/IntuneAssignmentChecker -Repository PSGallery -NuGetApiKey $env:PS_GALLERY_API_KEY

.github/workflows/publish-script.yml

@@ -0,0 +1,62 @@
+@{
+    RootModule        = 'IntuneAssignmentChecker.psm1'
+    ModuleVersion     = '4.0.0'
+    GUID              = 'c6e25ec6-5787-45ef-95af-8abeb8a17daf'
+    Author            = 'Ugur Koc'
+    CompanyName       = 'Community'
+    Copyright         = '(c) Ugur Koc. All rights reserved.'
+    Description       = 'Analyze and audit Microsoft Intune policy assignments. Check user, group, and device assignments, simulate group membership changes, search policies and settings, generate HTML reports, and more.'
+    PowerShellVersion = '7.0'
+    RequiredModules   = @('Microsoft.Graph.Authentication')
+    FunctionsToExport = @(
+        'Invoke-IntuneAssignmentChecker'
+        'Connect-IntuneAssignmentChecker'
+        'Get-IntuneUserAssignment'
+        'Get-IntuneGroupAssignment'
+        'Get-IntuneDeviceAssignment'
+        'Get-IntuneAllPolicies'
+        'Get-IntuneAllUsersAssignment'
+        'Get-IntuneAllDevicesAssignment'
+        'New-IntuneHTMLReport'
+        'Get-IntuneUnassignedPolicy'
+        'Get-IntuneEmptyGroup'
+        'Compare-IntuneGroupAssignment'
+        'Get-IntuneFailedAssignment'
+        'Test-IntuneGroupMembership'
+        'Test-IntuneGroupRemoval'
+        'Search-IntunePolicy'
+        'Search-IntuneSetting'
+        'Update-IntuneSettingDefinition'
+    )
+    CmdletsToExport   = @()
+    VariablesToExport  = @()
+    AliasesToExport    = @('IntuneAssignmentChecker')
+    FileList           = @(
+        'Data/SettingDefinitions.json'
+        'html-export.ps1'
+    )
+    PrivateData = @{
+        PSData = @{
+            Tags         = @('Intune', 'MEM', 'Endpoint', 'Assignment', 'Policy', 'Settings', 'Audit', 'Microsoft', 'Graph')
+            LicenseUri   = 'https://github.com/ugurkocde/IntuneAssignmentChecker/blob/main/LICENSE'
+            ProjectUri   = 'https://github.com/ugurkocde/IntuneAssignmentChecker'
+            IconUri      = ''
+            ReleaseNotes = @'
+Version 4.0.0:
+- BREAKING: Converted from script to PowerShell module (use Install-Module instead of Install-Script)
+- Add Option 12: Simulate Group Membership Impact
+- Add Option 13: Simulate Removing User from Group
+- Add Option 14: Search Policy Assignments (reverse lookup)
+- Add Option 15: Search for Specific Settings (across Settings Catalog and Endpoint Security)
+- Add terminal-width-aware separators
+- Add UPN format validation before network calls
+- Normalize y/n prompts to accept Y/y/Yes/yes
+- Fix app platform detection showing Windows apps (win32LobApp, winGetApp, microsoftStoreForBusinessApp, officeSuiteApp) as Multi-Platform in HTML report
+- Remove deprecated groupPolicyConfigurations (Administrative Templates) policy type
+- Migrate deviceStatuses API endpoints
+- Fix hardcoded Graph URLs to use dynamic GraphEndpoint
+- All features available as individual cmdlets (e.g., Get-IntuneUserAssignment, Search-IntuneSetting)
+'@
+        }
+    }
+}

Module/IntuneAssignmentChecker/Data/SettingDefinitions.json

@@ -0,0 +1,39 @@
+#Requires -Version 7.0
+#Requires -Modules Microsoft.Graph.Authentication
+
+# Module-scoped variables (set by Connect-IntuneAssignmentChecker)
+$script:GraphEndpoint = $null
+$script:GraphEnvironment = $null
+$script:CurrentTenantId = $null
+$script:CurrentTenantName = $null
+$script:CurrentUserUPN = $null
+$script:TemplateIdToFamilyCache = $null
+$script:ScopeTagLookup = $null
+$script:IntentTemplateSubtypeToFamily = @{
+    'antivirus'                       = 'endpointSecurityAntivirus'
+    'diskEncryption'                  = 'endpointSecurityDiskEncryption'
+    'firewall'                        = 'endpointSecurityFirewall'
+    'endpointDetectionAndResponse'    = 'endpointSecurityEndpointDetectionAndResponse'
+    'attackSurfaceReduction'          = 'endpointSecurityAttackSurfaceReduction'
+    'accountProtection'               = 'endpointSecurityAccountProtection'
+}
+
+# Dot-source all private functions
+$Private = @(Get-ChildItem -Path "$PSScriptRoot/Private/*.ps1" -ErrorAction SilentlyContinue)
+foreach ($file in $Private) {
+    try { . $file.FullName }
+    catch { Write-Error "Failed to load $($file.FullName): $_" }
+}
+
+# Dot-source all public functions
+$Public = @(Get-ChildItem -Path "$PSScriptRoot/Public/*.ps1" -ErrorAction SilentlyContinue)
+foreach ($file in $Public) {
+    try { . $file.FullName }
+    catch { Write-Error "Failed to load $($file.FullName): $_" }
+}
+
+# Create alias for interactive mode
+New-Alias -Name 'IntuneAssignmentChecker' -Value 'Invoke-IntuneAssignmentChecker' -Force
+
+# Export public functions and alias
+Export-ModuleMember -Function $Public.BaseName -Alias 'IntuneAssignmentChecker'

Module/IntuneAssignmentChecker/IntuneAssignmentChecker.psd1

@@ -0,0 +1,18 @@
+function Add-AppExportData {
+    param (
+        [System.Collections.ArrayList]$ExportData,
+        [string]$Category,
+        [object[]]$Apps,
+        [string]$AssignmentReason = "N/A"
+    )
+
+    foreach ($app in $Apps) {
+        $appName = if ($app.displayName) { $app.displayName } else { $app.name }
+        $null = $ExportData.Add([PSCustomObject]@{
+                Category         = $Category
+                Item             = "$appName (ID: $($app.id))"
+                ScopeTags        = Get-ScopeTagNames -ScopeTagIds $app.roleScopeTagIds -ScopeTagLookup $script:ScopeTagLookup
+                AssignmentReason = "$AssignmentReason - $($app.AssignmentIntent)"
+            })
+    }
+}

Module/IntuneAssignmentChecker/IntuneAssignmentChecker.psm1

@@ -0,0 +1,34 @@
+function Add-ExportData {
+    param (
+        [System.Collections.ArrayList]$ExportData,
+        [string]$Category,
+        [object[]]$Items,
+        [Parameter(Mandatory = $false)]
+        [object]$AssignmentReason = "N/A"
+    )
+
+    foreach ($item in $Items) {
+        $itemName = if ($item.displayName) { $item.displayName } else { $item.name }
+
+        # Handle different types of assignment reason input
+        $reason = if ($AssignmentReason -is [scriptblock]) {
+            & $AssignmentReason $item
+        }
+        elseif ($item.AssignmentReason) {
+            $item.AssignmentReason
+        }
+        elseif ($item.AssignmentSummary) {
+            $item.AssignmentSummary
+        }
+        else {
+            $AssignmentReason
+        }
+
+        $null = $ExportData.Add([PSCustomObject]@{
+                Category         = $Category
+                Item             = "$itemName (ID: $($item.id))"
+                ScopeTags        = Get-ScopeTagNames -ScopeTagIds $item.roleScopeTagIds -ScopeTagLookup $script:ScopeTagLookup
+                AssignmentReason = $reason
+            })
+    }
+}

Module/IntuneAssignmentChecker/Private/Add-AppExportData.ps1

@@ -0,0 +1,20 @@
+function Add-IntentTemplateFamilyInfo {
+    param (
+        [Parameter(Mandatory = $false)]
+        $IntentPolicies
+    )
+
+    if (-not $IntentPolicies) { return }
+
+    $lookup = Get-IntentTemplateFamilyLookup
+
+    foreach ($intent in $IntentPolicies) {
+        if ($intent.templateId -and $lookup.ContainsKey($intent.templateId)) {
+            if (-not $intent.templateReference) {
+                $intent | Add-Member -NotePropertyName 'templateReference' -NotePropertyValue @{
+                    templateFamily = $lookup[$intent.templateId]
+                }
+            }
+        }
+    }
+}

Module/IntuneAssignmentChecker/Private/Add-ExportData.ps1

@@ -0,0 +1,53 @@
+function Export-PolicyData {
+    param (
+        [Parameter(Mandatory = $true)]
+        [System.Collections.ArrayList]$ExportData,
+        [Parameter(Mandatory = $true)]
+        [string]$FilePath
+    )
+
+    $extension = [System.IO.Path]::GetExtension($FilePath).ToLower()
+
+    if ($extension -eq '.xlsx') {
+        # Check if ImportExcel module is installed
+        if (-not (Get-Module -ListAvailable -Name ImportExcel)) {
+            Write-Host "The ImportExcel module is required for Excel export. Would you like to install it? (y/n)" -ForegroundColor Yellow
+            $install = Read-Host
+            if ($install -match '^[Yy]') {
+                try {
+                    Install-Module -Name ImportExcel -Force -Scope CurrentUser
+                    Write-Host "ImportExcel module installed successfully." -ForegroundColor Green
+                }
+                catch {
+                    Write-Host "Failed to install ImportExcel module. Falling back to CSV export." -ForegroundColor Red
+                    $FilePath = [System.IO.Path]::ChangeExtension($FilePath, '.csv')
+                    $ExportData | Export-Csv -Path $FilePath -NoTypeInformation
+                    Write-Host "Results exported to $FilePath" -ForegroundColor Green
+                    return
+                }
+            }
+            else {
+                Write-Host "Falling back to CSV export." -ForegroundColor Yellow
+                $FilePath = [System.IO.Path]::ChangeExtension($FilePath, '.csv')
+                $ExportData | Export-Csv -Path $FilePath -NoTypeInformation
+                Write-Host "Results exported to $FilePath" -ForegroundColor Green
+                return
+            }
+        }
+
+        try {
+            $ExportData | Export-Excel -Path $FilePath -AutoSize -AutoFilter -WorksheetName "Intune Assignments" -TableName "IntuneAssignments"
+            Write-Host "Results exported to $FilePath" -ForegroundColor Green
+        }
+        catch {
+            Write-Host "Failed to export to Excel. Falling back to CSV export." -ForegroundColor Red
+            $FilePath = [System.IO.Path]::ChangeExtension($FilePath, '.csv')
+            $ExportData | Export-Csv -Path $FilePath -NoTypeInformation
+            Write-Host "Results exported to $FilePath" -ForegroundColor Green
+        }
+    }
+    else {
+        $ExportData | Export-Csv -Path $FilePath -NoTypeInformation
+        Write-Host "Results exported to $FilePath" -ForegroundColor Green
+    }
+}