Update V4.1.0 - New Features

A huge thank you to the community for helping make this release possible!

@Matthijsy: Added an option to continue UAL Graph collection.
@cirosec-ffr: Implemented the -usev1 switch for get-ualgraph.
@k8pl3r-sh: Added QR Code PIN Authentication method to the get-mfa script.
@k8pl3r-sh - Local independent ISO 8601 date handling in PowerShell scripts
@oxnan - Fixed a bug with UAL collection when using a custom output directory.

Performance Improvements (Special thanks to @calvvvv)

• We improved how the scripts handle large datasets. By replacing standard Powershell arrays with System.Collections.Generic.List and optimizing loops, scripts are now faster across the board.
• Get-AdminUsers optimization: Implemented bulk OData filtering. Execution time in testing dropped from 152 seconds to just 22 seconds.
• O(1) Lookups: Added $recipientCache in Get-MailboxPermissions and $skusHash in Get-ProductLicenses to resolve recipients and SKUs instantly, rather than scanning per item.
• Pipeline Overhead Removal: Replaced expensive (... | Measure-Object).Count calls with fast @(...).Count arrays, and removed nested Export-Csv -Append commands in favor of single bulk exports.
• Get-Users Overhaul: Removed redundant Get-MgUser | Get-Member > $null API calls and condensed 9 separate Where-Object passes into a single, efficient foreach loop.

New Features & Enhancements

• Get-MailboxRulesGraph: Introduced a new script to fetch Inbox Rules directly via the Microsoft Graph API, providing a modern alternative to the traditional ExchangeOnlineManagement module approach.
• Get-SecureScore: Added a new script to pull Microsoft Secure Score metrics.
• Get-MailItemsAccessed: Added OperationProperties to the output (Requested by Juriaan).
• Get-UALGraph: Added retry logic with exponential backoff for status polling. The script will now gracefully handle transient gateway errors (502/503/504) without aborting your search jobs.
• Get-UALGraph: Added -AuditDataOnly switch: outputs only the auditData object per record, stripping the wrapper
• fields (id, createdDateTime, service, userPrincipalName, etc.) for cleaner downstream ingestion.
• Show-MailboxRules: Refactored the code to remove duplication and improve maintainability.

Get-UAL Collection rework:
Redesigned the Unified Audit Log collection method in response to backend Microsoft changes to Search-UnifiedAuditLog.

• Microsoft's ResultCount no longer reports the total query population size.
• Replaced session pagination with single non-session calls capped at 5,000 events. If a window hits exactly 5,000, the script automatically shrinks the time interval and refetches to guarantee no events are missed.
• Added an initial calibration probe that dynamically adapts the starting time interval based on the specific event density of the tenant.
• This also breaks the Get-UALStatistics script, we did remove it since it no longer works.