Purview Audit Log Processor v1.11.12

README.md

@@ -14,7 +14,7 @@
 
 <h3 align="center">PAX PowerShell Script&nbsp;&nbsp;|&nbsp;&nbsp;PAX Cookbook&nbsp;&nbsp;|&nbsp;&nbsp;PAX Cookbook Mini-Kitchen</h3>
 
-**⬇️ Download the script:** [`PAX_Purview_Audit_Log_Processor_v1.11.11.ps1`](https://github.com/microsoft/PAX/releases/download/purview-v1.11.11/PAX_Purview_Audit_Log_Processor_v1.11.11.ps1) &nbsp;|&nbsp; Release Date: July 2, 2026
+**⬇️ Download the script:** [`PAX_Purview_Audit_Log_Processor_v1.11.12.ps1`](https://github.com/microsoft/PAX/releases/download/purview-v1.11.12/PAX_Purview_Audit_Log_Processor_v1.11.12.ps1) &nbsp;|&nbsp; Release Date: July 3, 2026
 
 **📖 Script Resources:** [Latest Documentation](https://github.com/microsoft/PAX/blob/release/release_documentation/Purview_Audit_Log_Processor/PAX_Purview_Audit_Log_Processor_Documentation_v1.11.x.md) | [Latest Release Notes](https://github.com/microsoft/PAX/blob/release/release_notes/Purview_Audit_Log_Processor/PAX_Purview_Audit_Log_Processor_Release_Note_v1.11.x.md)
 

release_documentation/.gitkeep

@@ -1 +1 @@
-# Last updated: 2026-07-02 (Purview v1.11.11, Graph v1.0.1, CopilotInteractions v2.0.0, PAX Umbrella v1.0.33)
+# Last updated: 2026-07-03 (Purview v1.11.12, Graph v1.0.1, CopilotInteractions v2.0.0, PAX Umbrella v1.0.34)

release_documentation/Purview_Audit_Log_Processor/PAX_Purview_Audit_Log_Processor_Documentation_v1.11.x.md

@@ -1,16 +1,16 @@
 # Portable Audit eXporter (PAX) - <br/>Purview Audit Log Processor
 
-> **📥 Quick Start:** Download the script → [`PAX_Purview_Audit_Log_Processor_v1.11.11.ps1`](https://github.com/microsoft/PAX/releases/download/purview-v1.11.11/PAX_Purview_Audit_Log_Processor_v1.11.11.ps1)
+> **📥 Quick Start:** Download the script → [`PAX_Purview_Audit_Log_Processor_v1.11.12.ps1`](https://github.com/microsoft/PAX/releases/download/purview-v1.11.12/PAX_Purview_Audit_Log_Processor_v1.11.12.ps1)
 >
-> **📅 Script v1.11.11 Release Date:** July 2, 2026
+> **📅 Script v1.11.12 Release Date:** July 3, 2026
 >
 > **📋 Release Notes:** See what's new → [v1.11.x Release Notes](https://github.com/microsoft/PAX/blob/release/release_notes/Purview_Audit_Log_Processor/PAX_Purview_Audit_Log_Processor_Release_Note_v1.11.x.md) | [All Release Notes](https://github.com/microsoft/PAX/tree/release/release_notes/Purview_Audit_Log_Processor)
 >
 > **📜 Script Archive:** [All Script Versions](https://github.com/microsoft/PAX/releases?q=purview-&expanded=true)
 >
 > **📚 Documentation Archive:** [All Documentation](https://github.com/microsoft/PAX/tree/release/release_documentation/Purview_Audit_Log_Processor)
 
-**Documentation Version:** v1.11.x (Current Script Version: v1.11.11)  
+**Documentation Version:** v1.11.x (Current Script Version: v1.11.12)  
 **Audience:** IT admins, security/compliance analysts, BI/data teams  
 **Runtime:** PowerShell 7+ (required for default Graph API mode); PowerShell 5.1 supported only with `-UseEOM`  
 **License:** MIT
@@ -406,7 +406,7 @@ The **Purview Audit Reader** role is only required for EOM mode (`-UseEOM`) and
 
 ### Download the Script
 
-- **Script:** [PAX_Purview_Audit_Log_Processor_v1.11.11.ps1](https://github.com/microsoft/PAX/releases/download/purview-v1.11.11/PAX_Purview_Audit_Log_Processor_v1.11.11.ps1)
+- **Script:** [PAX_Purview_Audit_Log_Processor_v1.11.12.ps1](https://github.com/microsoft/PAX/releases/download/purview-v1.11.12/PAX_Purview_Audit_Log_Processor_v1.11.12.ps1)
 - **Release Notes:** [v1.11.x](https://github.com/microsoft/PAX/blob/release/release_notes/Purview_Audit_Log_Processor/PAX_Purview_Audit_Log_Processor_Release_Note_v1.11.x.md)
 
 Save the downloaded script to a working directory (e.g., `C:\Scripts\PAX\`).
@@ -3561,16 +3561,18 @@ Adding `-Deidentify` to a rollup run anonymizes the rolled-up output as well —
 
 When you point a rollup run at an existing rollup file with `-AppendFile`, PAX merges this run's rolled-up interactions into that file instead of writing a brand-new one, so you can grow a single dataset across many runs (for example, a monthly refresh onto a running history).
 
-**Reconciliation on stable message identity.** The append merge reconciles on each interaction's **stable message identity**, so overlapping records between runs are matched and de-duplicated, brand-new records are added, and records that are only in the existing file are preserved. The result is an exact union — no interaction is dropped, and overlaps are never double-counted.
+**Reconciliation on the full analytical grain + stable message identity.** A single interaction (message) can produce **several** rolled-up rows — one per distinct combination of the analytical grain (for example, per accessed resource). The append merge reconciles on the **full grain together with each interaction's stable message identity**, so every one of those rows is matched independently: overlapping rows between runs are matched and de-duplicated, brand-new rows are added, and rows that are only in the existing file are preserved. The result is an exact union — no row is dropped (even when several rows share the same message), and overlaps are never double-counted.
 
-**One-time re-baseline for older seed files.** Append files created by **earlier versions of PAX** were written without the stable identity key the reconciliation relies on. To protect your data, PAX **does not silently merge** onto one of these older files:
+**One-time re-baseline for older seed files.** Append files created by **earlier versions of PAX** were written without every column the current reconciliation relies on — older files may lack the stable message identity key entirely, and files created **before v1.11.12** may lack a grain-composite column the fan-out-safe merge needs (for example, the AIO rolled-up interactions file gained a stable user-identity column in v1.11.12). To protect your data, PAX **does not silently merge** onto one of these older files:
 
 - The existing file is **left completely untouched**.
 - This run's rolled-up output is written to a **new, timestamped file** alongside it.
 - PAX prints clear **re-baseline guidance** to the screen and the run log.
 
 **What this means for you:** an append file you started with an **earlier version** needs a **one-time re-baseline** — generate a fresh rollup file with the current version once and use that as your new append target. From then on, every `-AppendFile` run reconciles and grows correctly. **No data is lost** in the process: your original file is preserved as-is, and this run's data is safely written to the new file.
 
+> **Note (v1.11.12):** if you have been appending onto an **AIO** rolled-up interactions file created before v1.11.12, expect this one-time re-baseline on your next run — the fan-out-safe merge needs a stable user-identity column that older AIO files do not carry. Your existing file is left untouched and the run writes a fresh, timestamped file to re-baseline from. AIBV files created in v1.11.11 already carry the needed identity column.
+
 **The rolled-up Users dimension always uploads.** When a rollup run also produces the Users dimension (the org / licensing companion to the interactions file), that Users file is uploaded correctly in **all four** combinations of interactions-append and Users destination — whether the interactions stream is appending or not, and whether the Users destination is `-OutputPathUserInfo` or `-AppendUserInfo`. It uploads exactly once in every case.
 
 </details>

release_notes/.gitkeep

@@ -1 +1 @@
-# Last updated: 2026-07-02 (Purview v1.11.11, Graph v1.0.1, CopilotInteractions v2.0.0, PAX Umbrella v1.0.33)
+# Last updated: 2026-07-03 (Purview v1.11.12, Graph v1.0.1, CopilotInteractions v2.0.0, PAX Umbrella v1.0.34)

release_notes/Purview_Audit_Log_Processor/PAX_Purview_Audit_Log_Processor_Release_Note_v1.11.x.md

@@ -2,8 +2,8 @@
 
 ## Release Information
 
-- **Latest Version:** 1.11.11
-- **Latest Release Date:** July 2, 2026
+- **Latest Version:** 1.11.12
+- **Latest Release Date:** July 3, 2026
 - **Released By:** Microsoft Copilot Growth ROI Advisory Team (copilot-roi-advisory-team-gh@microsoft.com)
 
 ---
@@ -12,13 +12,29 @@
 
 Download the script below.  For questions or issues, refer to the documentation.
 
-- **PAX Purview Audit Log Processor Script v1.11.11:** [PAX_Purview_Audit_Log_Processor_v1.11.11.ps1](https://github.com/microsoft/PAX/releases/download/purview-v1.11.11/PAX_Purview_Audit_Log_Processor_v1.11.11.ps1)
+- **PAX Purview Audit Log Processor Script v1.11.12:** [PAX_Purview_Audit_Log_Processor_v1.11.12.ps1](https://github.com/microsoft/PAX/releases/download/purview-v1.11.12/PAX_Purview_Audit_Log_Processor_v1.11.12.ps1)
 - **Documentation v1.11.x (Markdown):** [PAX_Purview_Audit_Log_Processor_Documentation_v1.11.x.md](https://github.com/microsoft/PAX/blob/release/release_documentation/Purview_Audit_Log_Processor/PAX_Purview_Audit_Log_Processor_Documentation_v1.11.x.md)
 
 ---
 
 ## Overview
 
+### v1.11.12
+
+Version 1.11.12 fixes a cross-run `-AppendFile` reconciliation problem in the rolled-up interactions file, adds a supporting identity column to the AI-in-One (AIO) rolled-up interactions file, and improves the reliability of the Microsoft Agent 365 catalog export. Runs that do not append rolled-up interactions and do not use Agent 365 behave as in v1.11.11, with one additive exception: the AIO rolled-up interactions file now carries one extra identity column (described below). A one-time re-baseline applies to interaction append files created before v1.11.12.
+
+#### Fan-Out-Safe Cross-Run Append & One-Time Re-Baseline (`-AppendFile`)
+
+A single interaction (message) can produce **several** rolled-up rows — one per distinct combination of the analytical grain (for example, per accessed resource). v1.11.11 reconciled an appended rollup on the message identity alone, which treated all of a message's rows as one and could drop the extra rows when a later run re-emitted only some of them. v1.11.12 reconciles on the **full grain together with the message identity**, so every row is matched independently: overlapping rows de-duplicate, new rows are added, and existing-only rows are preserved — an exact union with nothing dropped or double-counted. To protect your data, PAX does **not** silently merge onto an append file that predates this change or that lacks any column the new reconciliation needs (for example an older AIO file created before the new identity column existed). Instead it leaves the old file untouched, writes this run's output to a new timestamped file, and prints re-baseline guidance. The practical effect is a **one-time re-baseline** — generate a fresh file once with v1.11.12 and append onto that from then on — with **no data lost** in the transition.
+
+#### Stable User Identity on the AI-in-One Rolled-Up Interactions File
+
+The AIO rolled-up interactions file now carries a stable, normalized user-identity column (`User_Id_Normalized`), matching the equivalent column the AI Business Value (AIBV) rollup already provides. It is **additive** — every existing column is unchanged — and it anchors the cross-run reconciliation above on a stable identity rather than a per-run surrogate. When `-Deidentify` is used, this column is anonymized with the same irreversible, format-preserving token as every other identity in the output, so it never exposes a raw user identity.
+
+#### Microsoft Agent 365 Catalog — Reliability
+
+The Microsoft Agent 365 catalog export is more resilient to Microsoft Graph throttling: catalog reads now retry automatically on rate-limit (HTTP 429) and transient server responses, honoring the service's `Retry-After` timing when provided. An internal variable-naming issue in the package-details path that could interfere with per-package processing is also corrected. There are no new switches and no change to how you run the Agent 365 export.
+
 ### v1.11.11
 
 Version 1.11.11 delivers the real fix for a cross-run `-AppendFile` reconciliation problem that persisted through v1.11.10 (reported by two customers), closes an Entra Users upload gap in a specific rollup + append combination, adds a new `-UserInfoFile` switch that lets you supply the user/organization directory from your own CSV instead of pulling it live from Entra, and extends the Microsoft Agent 365 catalog export to support app-only authentication (opt-in / pre-GA) in addition to interactive sign-in. Runs that use none of these paths behave as in v1.11.10, with one additive exception: the rolled-up interactions file now carries two trailing provenance columns used for reliable cross-run de-duplication.
@@ -235,6 +251,12 @@ New sixth value on the `-Auth` ValidateSet for Azure-hosted headless execution (
 
 ## What's New
 
+### v1.11.12
+
+- **Fan-out-safe cross-run append + one-time re-baseline (`-AppendFile`).** A single interaction (message) can produce **several** rolled-up rows — one per distinct combination of the analytical grain (for example, per accessed resource). Rollup append now reconciles on the **full grain together with the message identity** rather than the message identity alone, so every row is matched independently — overlaps de-duplicate, new rows are added, and existing-only rows are preserved (exact union, nothing dropped or double-counted). Append files created before v1.11.12 — or any file missing a column the new reconciliation needs (for example an older AI-in-One file created before the new identity column existed) — are **not** silently merged: the old file is left untouched, this run's output is written to a new timestamped file, and PAX prints re-baseline guidance. The practical effect is a **one-time re-baseline** (generate a fresh file once with v1.11.12 and append onto that from then on), with **no data lost** in the transition. The existing 0-row overwrite refusal and union-shrink protections still apply.
+- **Stable user identity on the AI-in-One rolled-up interactions file (`User_Id_Normalized`).** The AI-in-One (AIO) rollup now carries a stable, normalized user-identity column, matching the equivalent column the AI Business Value (AIBV) rollup already provides. It is **additive** — every existing column is unchanged and it sits ahead of the trailing provenance columns — and it anchors the cross-run reconciliation above on a stable identity rather than a per-run surrogate. Under `-Deidentify` it is anonymized with the same irreversible, format-preserving token as every other identity in the output, so it never exposes a raw user identity.
+- **Microsoft Agent 365 catalog — throttling resilience.** Catalog reads now retry automatically on rate-limit (HTTP 429) and transient server (5xx) responses, honoring the service's `Retry-After` timing when provided and otherwise backing off exponentially (capped at 60 seconds); non-throttling errors surface immediately. An internal variable-naming issue in the package-details path that could interfere with per-package processing is also corrected. There are no new switches and no change to how you run the Agent 365 export.
+
 ### v1.11.11
 
 - **Reliable cross-run append + one-time re-baseline (`-AppendFile`).** Rollup append now reconciles on each interaction's stable message identity — overlaps de-duplicate, new records are added, existing-only records are preserved (exact union, nothing dropped or double-counted). Append files created before v1.11.11 are **not** silently merged: the old file is left untouched, this run's output is written to a new timestamped file, and PAX prints re-baseline guidance. Older append files need a **one-time re-baseline**; **no data is lost**.

script_archive/.gitkeep

@@ -1 +1 @@
-# Last updated: 2026-07-02 (Purview v1.11.11, Graph v1.0.1, CopilotInteractions v2.0.0, PAX Umbrella v1.0.33)
+# Last updated: 2026-07-03 (Purview v1.11.12, Graph v1.0.1, CopilotInteractions v2.0.0, PAX Umbrella v1.0.34)