Release v4.3.1 with least-privilege group access

[ugurkocde]

Summary

• replace the broad Group.Read.All permission with GroupMember.Read.All
• preserve group lookup, membership, and transitive membership behavior
• document automatic delegated scope requests and manual app-only consent
• add migration guidance for revoking the legacy application role
• add regression coverage for permission configuration and paginated transitive memberships
• bump the module and release notes to stable v4.3.1

Security impact

This reduces the application permission from access to groups and Microsoft 365 group content to basic group properties and memberships needed by IntuneAssignmentChecker.

Existing app-only registrations must add and consent GroupMember.Read.All before removing and revoking Group.Read.All. Interactive connections request the delegated permission automatically on the next sign-in, subject to administrator consent.

Validation

• Pester: 162 passed, 0 failed
• PowerShell syntax parsing: passed
• module manifest: 4.3.1
• module import: 19 exported commands
• PSScriptAnalyzer: 0 errors
• diff whitespace check: passed

[github-actions]

PSScriptAnalyzer Results

Found 0 error(s) and 5 warning(s).

See the workflow run for details.