IntuneAssignmentChecker 5.0.0: PowerShell-native TUI and governance platform

[ugurkocde]

Summary

• ship IntuneAssignmentChecker 5.0.0 from one PowerShell module codebase with no generated executable or .NET wrapper
• replace the command-form wrapper with a native task-oriented Command Center covering every operational public command across 11 workspaces
• support mouse clicks, wheel scrolling, complete keyboard navigation, responsive terminal rendering, clean cancellation, and the approved Draft A layout with the Draft B palette
• add assignment governance, change simulation, attributed drift, multi-tenant fleet scans, capability-based authentication, delivery health, RBAC analysis, filter governance, diagnostics, and resumable scans
• add structured non-prompting output to legacy workflows so the module API and TUI share the same implementation
• package the PowerShell module and pinned Graph Authentication dependency in an MSI for WinGet
• install a non-executable IntuneAssignmentChecker command handoff that automatically starts the same module in PowerShell 7 when called from Windows PowerShell 5.1 or Command Prompt

Validation

• 403/403 unit tests passed locally
• 7/7 release-package tests passed locally
• CI-equivalent PSScriptAnalyzer run: 128 files, 0 errors
• staged diff whitespace check passed
• Claude Code using exact model claude-opus-5 completed the implementation and packaging review loops; every blocking, high, and medium finding was resolved and the latest verdict was PASS
• Lokka live read-only beta verification covered assignment filters, audit events, and role assignments, including response shapes, paging, and representative error behavior

TUI behavior

• starts disconnected and guides tenant/cloud, authentication, and least-privilege capability selection inside the UI
• keeps governance and simulation read-only by default
• separates semantic records from display-only progress, warnings, and errors so metrics and exports cannot report false success
• enforces full task parity at startup and in release-package validation
• includes an HTML concept preview matching the implemented layout and palette

PowerShell 5.1 handoff

• WinGet continues to install PowerShell 7 as a dependency
• after opening a new terminal, IntuneAssignmentChecker resolves to an administrator-protected CMD handoff on Windows
• the handoff prefers the canonical 64-bit PowerShell 7 installation and immediately invokes Start-IntuneAssignmentCheckerTui from the module
• the MSI lifecycle test verifies command installation, machine PATH registration, a real cmd-to-pwsh import, and complete uninstall cleanup
• the launcher payload is normalized to CRLF at build time so package correctness does not depend on the build host or Git settings

Release notes

• release MSI signing intentionally fails closed unless WINDOWS_SIGNING_CERTIFICATE and WINDOWS_SIGNING_PASSWORD are configured
• the workflow generates the three WinGet manifest files after signing so their installer hash matches the release artifact
• first publication to microsoft/winget-pkgs remains the post-release submission step because the signed v5.0.0 asset URL must exist first

[github-actions]

PSScriptAnalyzer Results

Errors: 0 · Warnings: 240

Open workflow run

[ugurkocde]

Closing without merge after hands-on Windows validation. The terminal UI and WinGet/MSI direction will not be pursued; IntuneAssignmentChecker will remain a PowerShell module on the 4.x line.