IDENTITYGUARD ENTRA COLLECTOR V0.4
==================================

V0.4 adds application consent and permission intelligence.

New application data
--------------------
- Application registrations
- Matching enterprise application / service principal
- Application owners
- Configured API permissions
- Granted application (app-only) permissions
- Delegated OAuth permission grants
- Tenant-wide delegated-consent indicator
- Client-secret and certificate metadata
- Credential age and days to expiration
- Publisher / verified-publisher metadata when available

Read-only delegated Microsoft Graph permissions
------------------------------------------------
- User.Read.All
- AuditLog.Read.All
- RoleManagement.Read.Directory
- Policy.Read.All
- Application.Read.All
- Directory.Read.All
- GroupMember.Read.All

The collector never writes client-secret values, certificate private keys,
passwords, or Microsoft Graph access tokens into the assessment JSON.

Run
---
  .\IdentityGuard-Entra-Collector-V0.4.ps1

Anonymized:
  .\IdentityGuard-Entra-Collector-V0.4.ps1 -Anonymize

Then import the generated JSON into:
  https://labs.snehashispriyabarua.com/identityguard/

Some Microsoft Graph operations also require the signed-in administrator to
hold a supported Microsoft Entra directory role.
