purview-v1.11.10

README.md

@@ -14,7 +14,7 @@
 
 <h3 align="center">PAX PowerShell Script&nbsp;&nbsp;|&nbsp;&nbsp;PAX Cookbook&nbsp;&nbsp;|&nbsp;&nbsp;PAX Cookbook Mini-Kitchen</h3>
 
-**⬇️ Download the script:** [`PAX_Purview_Audit_Log_Processor_v1.11.9.ps1`](https://github.com/microsoft/PAX/releases/download/purview-v1.11.9/PAX_Purview_Audit_Log_Processor_v1.11.9.ps1) &nbsp;|&nbsp; Release Date: June 25, 2026
+**⬇️ Download the script:** [`PAX_Purview_Audit_Log_Processor_v1.11.10.ps1`](https://github.com/microsoft/PAX/releases/download/purview-v1.11.10/PAX_Purview_Audit_Log_Processor_v1.11.10.ps1) &nbsp;|&nbsp; Release Date: June 25, 2026
 
 **📖 Script Resources:** [Latest Documentation](https://github.com/microsoft/PAX/blob/release/release_documentation/Purview_Audit_Log_Processor/PAX_Purview_Audit_Log_Processor_Documentation_v1.11.x.md) | [Latest Release Notes](https://github.com/microsoft/PAX/blob/release/release_notes/Purview_Audit_Log_Processor/PAX_Purview_Audit_Log_Processor_Release_Note_v1.11.x.md)
 

fabric_resources/CompatibilityMatrix.md

@@ -2,13 +2,6 @@
 
 _This document captures the supported runtime contract for PAX as it is currently shipped._
 
-> [!IMPORTANT]
-> **Microsoft Agent 365 enrichment is temporarily disabled pending further testing.**
-> The switches `-IncludeAgent365Info`, `-OnlyAgent365Info`, `-OutputPathAgent365Info`,
-> and `-AppendAgent365Info` are gated at script startup and will cause PAX to exit
-> immediately with a notice. References to Agent 365 elsewhere in this document are
-> preserved for when the feature is re-enabled.
-
 This document captures the **supported runtime contract** for PAX when run under any
 of the three packaging modes (local pwsh, Azure Container Apps Job, Fabric notebook).
 Operators planning a deployment should treat each row as a hard requirement unless
@@ -94,7 +87,7 @@ Three trailing columns are appended at merge time to **any appended file**:
 | `Latest_Append_Date` | `YYYY-MM-DD` | Latest run timestamp that touched the file. Same value on every row; updated each append. |
 | `In_Latest_Append` | `TRUE` / `FALSE` | Whether the row appeared in the latest run's audit window or membership snapshot. `FALSE` for retained-but-departed rows. |
 
-The CopilotInteraction rollup Fact CSV additionally carries two trailing identity columns (always present, not just at append time) so per-run integer surrogates remain stable across appends: **`Message_Id_Raw`** (raw audit `Messages[].Id` GUID) and **`ThreadId_Raw`** (raw `CopilotEventData.ThreadId` GUID). Merge keys: `Message_Id_Raw` for the rollup Fact CSV, `RecordId` for the non-rollup raw audit CSV, `PersonId_Normalized` for the EntraUsers CSV, `AgentId` for the Agent 365 CSV.
+The CopilotInteraction rollup Fact CSV additionally carries two trailing identity columns (always present, not just at append time) so per-run integer surrogates remain stable across appends: **`Message_Id_Raw`** (raw audit `Messages[].Id` GUID) and **`ThreadId_Raw`** (raw `CopilotEventData.ThreadId` GUID). Merge keys: `Message_Id` for the rollup Fact CSV, `RecordId` for the non-rollup raw audit CSV, `PersonId_Normalized` for the EntraUsers CSV, `AgentId` for the Agent 365 CSV.
 
 **Deidentification (`-Deidentify`) and merge keys.** Under `-Deidentify`, identity values are replaced with irreversible deterministic tokens before any write. The documented merge keys remain usable: `PersonId_Normalized` is tokenized but deterministic (so EntraUsers/Users joins and distinct counts are preserved across runs), while `Message_Id_Raw` / `ThreadId_Raw` are message/thread GUIDs that are **not** tokenized. A run's deidentify state is detected from the target's identity columns; appending a `-Deidentify` run into a non-deidentified target (or the reverse) is hard-rejected at pre-flight to prevent token/raw identity mixing. `-Deidentify` is persisted in the checkpoint and restored on `-Resume`.
 

fabric_resources/Deploy/Deploy-PAXAcaJob.ps1

@@ -4,12 +4,6 @@
     Processor against a SharePoint or Fabric/OneLake destination.
 
 .DESCRIPTION
-    IMPORTANT: Microsoft Agent 365 enrichment is temporarily disabled pending further
-    testing. The switches -IncludeAgent365Info, -OnlyAgent365Info,
-    -OutputPathAgent365Info, and -AppendAgent365Info are gated at PAX startup and
-    will cause the script to exit immediately with a notice. References to Agent 365
-    elsewhere in this help text are preserved for when the feature is re-enabled.
-
     Provisions (or idempotently updates) an ACA Job using the pre-built container image
     from your Azure Container Registry. The job runs on a manual or scheduled trigger,
     authenticates via a user-assigned managed identity, and writes outputs to either

fabric_resources/Deploy/README.md

@@ -1,11 +1,8 @@
 # PAX Purview Audit Log Processor — ACA Job Deployment (Container path)
 
 > [!IMPORTANT]
-> **Microsoft Agent 365 enrichment is temporarily disabled pending further testing.**
-> The switches `-IncludeAgent365Info`, `-OnlyAgent365Info`, `-OutputPathAgent365Info`,
-> and `-AppendAgent365Info` are gated at script startup and will cause PAX to exit
-> immediately with a notice. References to Agent 365 elsewhere in this document are
-> preserved for when the feature is re-enabled.
+> **Microsoft Agent 365 enrichment is fully supported.**
+> The `-IncludeAgent365Info`, `-OnlyAgent365Info`, `-OutputPathAgent365Info`, and `-AppendAgent365Info` switches require interactive (delegated) sign-in by an AI Administrator or Global Administrator; ManagedIdentity is not supported for this stream.
 
 > **Two ways to use PAX with Fabric.** This README covers the **container path** — a scheduled, unattended run hosted on Azure Container Apps Jobs using a managed identity. If you want to run PAX directly from a laptop, on-prem server, or Azure VM and still write to Fabric/OneLake, see [`../LocalRun/README.md`](../LocalRun/README.md) (no container build, no ACR, no ACA — just PowerShell + an Entra identity that has Fabric workspace access). The top-level [`../README.md`](../README.md) compares the two paths side-by-side.
 

fabric_resources/LocalRun/README.md

@@ -1,12 +1,5 @@
 # PAX + Fabric — Local / Direct run (Path A)
 
-> [!IMPORTANT]
-> **Microsoft Agent 365 enrichment is temporarily disabled pending further testing.**
-> The switches `-IncludeAgent365Info`, `-OnlyAgent365Info`, `-OutputPathAgent365Info`,
-> and `-AppendAgent365Info` are gated at script startup and will cause PAX to exit
-> immediately with a notice. References to Agent 365 elsewhere in this document are
-> preserved for when the feature is re-enabled.
-
 Run PAX directly from a Windows laptop, on-prem server, or Azure VM and write outputs to a Fabric Lakehouse. **No container build, no ACR, no ACA, and no `Grant-PAXPermissions.ps1` are required.** This is the lower-setup path; pick it when you do not need a fully unattended Azure-hosted scheduled run, or when you need Microsoft Agent 365 enrichment (which is unsupported under managed identity — see the container path README).
 
 For the side-by-side comparison of this path vs. the container path, see [`../README.md`](../README.md).

fabric_resources/Prereqs/Grant-PAXPermissions.ps1

@@ -4,12 +4,6 @@
     Azure Container Apps Jobs writing to SharePoint or Fabric/OneLake.
 
 .DESCRIPTION
-    IMPORTANT: Microsoft Agent 365 enrichment is temporarily disabled pending further
-    testing. The switches -IncludeAgent365Info, -OnlyAgent365Info,
-    -OutputPathAgent365Info, and -AppendAgent365Info are gated at PAX startup and
-    will cause the script to exit immediately with a notice. References to Agent 365
-    elsewhere in this help text are preserved for when the feature is re-enabled.
-
     One-time bootstrap script. Performs (idempotently):
 
       1. Creates (or reuses) a user-assigned managed identity.

fabric_resources/Prereqs/README.md

@@ -1,11 +1,8 @@
 # PAX Purview Audit Log Processor — Prerequisites (Container path)
 
 > [!IMPORTANT]
-> **Microsoft Agent 365 enrichment is temporarily disabled pending further testing.**
-> The switches `-IncludeAgent365Info`, `-OnlyAgent365Info`, `-OutputPathAgent365Info`,
-> and `-AppendAgent365Info` are gated at script startup and will cause PAX to exit
-> immediately with a notice. References to Agent 365 elsewhere in this document are
-> preserved for when the feature is re-enabled.
+> **Microsoft Agent 365 enrichment is fully supported.**
+> The `-IncludeAgent365Info`, `-OnlyAgent365Info`, `-OutputPathAgent365Info`, and `-AppendAgent365Info` switches require interactive (delegated) sign-in by an AI Administrator or Global Administrator; ManagedIdentity is not supported for this stream.
 
 One-time setup before deploying the ACA Job. **Only required when you intend to run PAX as a containerized scheduled job on Azure Container Apps.** If you are running PAX directly from a host (laptop, on-prem server, Azure VM) and writing to Fabric/OneLake, see [`../LocalRun/README.md`](../LocalRun/README.md) instead — the prerequisites there are smaller and `Grant-PAXPermissions.ps1` is not required.
 

fabric_resources/README.md

@@ -1,12 +1,5 @@
 # PAX + Microsoft Fabric — the two supported paths
 
-> [!IMPORTANT]
-> **Microsoft Agent 365 enrichment is temporarily disabled pending further testing.**
-> The switches `-IncludeAgent365Info`, `-OnlyAgent365Info`, `-OutputPathAgent365Info`,
-> and `-AppendAgent365Info` are gated at script startup and will cause PAX to exit
-> immediately with a notice. References to Agent 365 elsewhere in this document are
-> preserved for when the feature is re-enabled.
-
 PAX writes Delta tables and files to a Microsoft Fabric Lakehouse whenever an `-OutputPath*` parameter points at a OneLake URL. **There are two officially supported hosting patterns** for that, and they have very different setup costs. Pick the one that matches how you actually want to run.
 
 | | **Path A — Local / direct run** | **Path B — Container (ACA Job)** |

release_documentation/.gitkeep

@@ -1 +1 @@
-# Last updated: 2026-06-25 (Purview v1.11.9, Graph v1.0.1, CopilotInteractions v2.0.0, PAX Umbrella v1.0.31)
+# Last updated: 2026-06-29 (Purview v1.11.10, Graph v1.0.1, CopilotInteractions v2.0.0, PAX Umbrella v1.0.32)