Installation & uninstall updates

docs/Microsoft-Insights/Usage-Guide.md

@@ -169,22 +169,22 @@ Microsoft Insights considers a feature in use when a qualifying activity is dete
 ![Microsoft Insights Overview - Light](../assets/Images/Screenshots/MI-system-user-admin-light.png#only-light){ loading=lazy }
 ![Microsoft Insights Overview - Dark](../assets/Images/Screenshots/MI-system-user-admin-dark.png#only-dark){ loading=lazy }
 
-1. **System (S)** - Automatically generated by Microsoft.
+1.  **System (S)** - Automatically generated by Microsoft.
     - **Examples**: Policy Checks, Compliance, Security Monitoring, etc.
-2. **User (U)** - Activity created by users interacting with Microsoft features.
+2.  **User (U)** - Activity created by users interacting with Microsoft features.
     - **Examples**: Sending emails, joining meetings, opening files, applying sensitivity labels, etc.
-3. **Admin (A)** - Activity performed by administrators managing or reviewing Microsoft features.
+3.  **Admin (A)** - Activity performed by administrators managing or reviewing Microsoft features.
     - **Examples**: Role activations, audit searches, policy changes, investigations, etc.
 
 Every feature will have an associated activity. Some features only have one activity, while others may have more than one.
 
 **Note**: A feature is considered "active" even if its activity is background or administrative in nature, if qualifying telemetry exists during the reporting period. Some products are measured primarily through user-driven actions. Others reflect value through system-driven and admin-driven activity. Some examples include:
 
-- **User Driven**
+-   **User Driven**
     - Teams
     - Exchange
     - SharePoint
-- **System & Admin**
+-   **System & Admin**
     - Defender for Identity
     - Conditional Access
     - Intune
@@ -202,13 +202,13 @@ The first phase of Microsoft Insights is pulling in data. If you have successful
 
 If data is not available in the platform or certain columns are grayed out, it is likely due to one of the following reasons:
 
-- **SHIELD Not Installed**
+-   **SHIELD Not Installed**
     - If SHIELD is not installed in your environment, the system will not be able to display any insights in the report. For steps to install SHIELD, see [Overview and Installation Requirements](/SHIELD/Prerequisites/Installation).
-- **Permissions Not Granted**
+-   **Permissions Not Granted**
     - The Microsoft Graph Reports API requires the `Reports.Read.All` permission to be granted for the workload. To resolve this issue, make sure the required API permissions have been consented to the Entra ID or reach out to the user who oversees granting permissions.
-- **API Access Not Available or Enabled**
+-   **API Access Not Available or Enabled**
     - This may be because the API has not been turned on yet or does not exist (such as a non-public API access).
-- **Organization Does Not Have Service Plan or License**
+-   **Organization Does Not Have Service Plan or License**
     - If a service plan or license is not active for the relevant Microsoft products, the system cannot retrieve or display usage information in the report. In this situation, you should check to confirm your organization's current service plans and licenses.
 
 ---

docs/SHIELD/Deploy/Reference/Uninstall.md

@@ -0,0 +1,79 @@
+# Uninstall
+
+This section covers how to uninstall or reset SHIELD's Deploy module infrastructure and outlines common considerations for support and recovery scenarios.
+
+---
+
+## Uninstalling SHIELD Deploy Infrastructure
+
+The SHIELD platform uses multiple Microsoft 365 services to create configuration components. Removing these components manually is complex and can break your tenant setup. Use the provided uninstall script only if directed by SHI support.
+
+!!! danger "Data Loss Warning"
+
+    If you uninstall the architecture, **you will clear out any managed objects and configurations** deployed by the Deploy module. This procedure should only be followed if SHI explicitly instructs you to do so.
+
+!!! note "Stateless Server Reminder"
+
+    SHIELD's application server is stateless. You can safely redeploy the app after cleanup without losing data stored in the Microsoft cloud (e.g., Intune tags, Entra groups).
+
+---
+
+## Uninstall Procedure
+
+1. **Stop the SHIELD server** to prevent regeneration of infrastructure during cleanup.
+
+2. **Download the uninstall script**:
+
+📥 [Uninstall-ShieldArchitecture.ps1](../../Scripts/Uninstall-ShieldArchitecture.ps1)
+
+1. **Remove all Microsoft.Graph modules** to prevent version conflicts:
+
+   ```powershell
+   Get-Module -Name '*Microsoft.Graph*' -ListAvailable | Uninstall-Module
+   ```
+
+!!! note
+
+        You may have to run the above command twice because the order of operations tries to uninstall a dependency first rather than last. Running it the second time will remove the remaining dependency.
+
+1. **Install the correct version of Microsoft Graph Beta modules**:
+
+   ```powershell
+   Install-Module -Name 'Microsoft.Graph.Beta' -RequiredVersion '2.1.0' -Scope 'AllUsers'
+   ```
+
+1. **Run the uninstall script** to remove SHIELD-deployed infrastructure.
+
+The script is designed to remove:
+- Entra ID groups and admin units
+- Intune scope tags
+- Conditional Access policies created by SHIELD
+
+It does **not** delete data outside the SHIELD-deployed infrastructure.
+
+---
+
+## FAQs & Recovery Notes
+
+### What if the uninstall script fails?
+
+Try re-running the script. It is designed to be idempotent and will retry safely. Make sure you have proper permissions and the correct PowerShell modules installed.
+
+### Can I re-deploy SHIELD after uninstalling?
+
+Yes. SHIELD can be redeployed using the same app interface or script, as long as all infrastructure components have been successfully removed.
+
+### What is not removed?
+
+- Audit logs in Entra ID
+- Device enrollment history
+- Local device configurations if not managed via Intune
+
+---
+
+## Related Pages
+
+- [Deploy Overview](../../Deploy/)
+- [Deploy Usage Guide](../../Deploy/Usage-Guide)
+- [Deployment](../../Deploy/Deployment/)
+- [Deploy Reference](../../Deploy/Reference/)

docs/SHIELD/Deploy/Troubleshooting.md

@@ -8,6 +8,6 @@ We are actively gathering feedback to build out comprehensive troubleshooting fl
 
 If you encounter any issues in the meantime:
 
-- Refer to the [Uninstall Guide](../Reference/Uninstall) for resetting the environment
+- Refer to the [Uninstall Guide](Reference/Uninstall) for resetting the environment
 - Review your deployment [prerequisites](../Prerequisites/)
 - Contact SHI Support for critical blocking errors

docs/SHIELD/Prerequisites/Installation.md

@@ -1,15 +1,25 @@
 # Overview and Installation Requirements
 
+!!! note "Microsoft Insights"
+
+    SHIELD is the data collection and processing layer that powers Microsoft Insights. If your organization plans to use Microsoft Insights, SHIELD must be installed and configured in your Azure environment using this installation guide. If you need help at any point, contact your IT or cloud team, or reach out to your SHI representative. For more details, see [Microsoft Insights](../../Microsoft-Insights/Usage-Guide/).
+
 ## Overview
 
-SHIELD is a self-hosted application deployed in a customer’s Azure App Service tenant. SHIELD collects and processes all necessary data exclusively within the customer’s environment, then returns only abstracted and fully anonymized results back to SHI for reporting. All requirements can be set up by the delivery team or customer prior to engagement. This guide explains how to install the SHIELD - Desktop application and run your first scan. For more information about requirements, pricing, and more, see [Prerequisites](/SHIELD/Prerequisites).
+SHIELD is a self-hosted application deployed in a customer’s Azure App Service tenant. SHIELD collects and processes all necessary data exclusively within the customer’s environment, then returns only abstracted and fully anonymized results back to SHI for reporting. All requirements can be set up by the delivery team or customer prior to engagement. This guide explains how to install the SHIELD - Desktop application and run your first scan. For more information about requirements, pricing, and more, see [Prerequisites](/SHIELD/Prerequisites/).
 
 !!! info "Security Considerations"
 
     While this application requires sensitive permissions to conduct the automated scan, by self-hosting the application, SHI does not represent a supply chain risk or path to compromise a customer environment via the SHIELD platform, as there is no control maintained beyond the initial point of installation. All code being run to conduct the automated discovery is available for code and security reviews prior to engagement upon request. Permissions exist for both the user initiating the report and the application itself. Code review is available upon request.
 
 ---
 
+## Installation Video
+
+<iframe width="560" height="315" src="https://www.youtube.com/embed/JEQB7EC4RTM?si=lOd7h6WeIrSfhUXx" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
+
+---
+
 ## Installation Prerequisites
 
 ### Disable Network Traffic Inspection
@@ -153,15 +163,14 @@ Make sure the user installing SHIELD is the **Owner** on the Azure subscription
 4.  Click **SHIELD**.
 5.  Click on the App Service that starts with "shield-xxxxxxxxx" (the x's are a random set of lower-case letters and numbers).
     -   **Deactivate Health Check (One time only)**
-        1. Click on the link next **Health Check**.
+        1. Click on the link next to **Health Check**.
         2. Uncheck the box next to **Health check** and click **Apply**.
         3. Click **Save**.
 6.  Click **Overview** in the left navigation bar.
 7.  In the top right corner, click on the **Default domain** link.
     - **Example**: shield-xxxxxx-xxxxxxxx.eastus-01.azurewebsites.net
 8.  Log in to the SHIELD web instance with the account that has the necessary Azure permissions.
 9.  Click on **Discover Module**.
-10. Click **Start Authentication Sync**. Then click **Start Report Collection** to start scanning the tenant environment.
-11. During the first scan, SHIELD - Desktop will open and request account credentials multiple times. Log in each time as required. You will also need to accept each set of permissions.
-12. Once the scan is complete, reports are available on the SHIELD web instance.
-    1. Click **Discover** in the left navigation pane and click **Overview**.
+10. Click **Start Report Collection** to start scanning the tenant environment.
+11. Once the scan is complete, reports are available on the SHIELD web instance.
+    1. Click **Discover** in the left navigation pane and click **Overview**.

docs/SHIELD/Reference/Register-Break-Glass.md → docs/SHIELD/Reference/Break-Glass/Register-Break-Glass.md

@@ -9,12 +9,12 @@ The last section of this guide explains how to add existing break glass accounts
 This section lists the steps to create a single break glass account.
 If you need to create two break glass accounts, you must go through the process below twice.
 Once you have two break glass accounts, you can follow the steps in the [last section](#add-break-glass-accounts-to-security-group) to add the break glass accounts to SHIELD's security group.
-For more information about properly generating, printing, and storing break glass accounts, see the [Break Glass Overview](./Break-Glass-Overview) page.
+For more information about properly generating, printing, and storing break glass accounts, see the [Break Glass Overview](Break-Glass-Overview.md) page.
 
 If necessary, repeat the steps below until you have two break glass accounts in your tenant.
 
 !!! failure "WARNING, HERE BE DRAGONS!"
-    Please read the [Break Glass Overview](./Break-Glass-Overview) page before preceding with the below.
+    Please read the [Break Glass Overview](Break-Glass-Overview.md) page before preceding with the below.
     Failure to secure your break glass account will lead to organization wide compromise.
     If you have ANY questions about the process, please reach out to your SHI or SHIELD representative.
 
@@ -39,7 +39,7 @@ If necessary, repeat the steps below until you have two break glass accounts in
 4. Click **Reset password**. A temporary password is displayed. Click on the copy icon next to the temporary password and paste it somewhere secure.
 5. Open a fresh in-private/incognito tab and navigate to [https://myaccount.microsoft.com](https://myaccount.microsoft.com){:target="_blank"}
 6. Log into your break glass account using the email address and temporary password you copied previously.
-7. You will be prompted to update your password by entering the temporary password and a new password. For more information about generating a password, see [Passwords](./Break-Glass-Overview#passwords).
+7. You will be prompted to update your password by entering the temporary password and a new password. For more information about generating a password, see [Passwords](Break-Glass-Overview.md#passwords).
 8. Store the new password in a safe location.
 
 ## Add break glass accounts to security group

docs/SHIELD/Reference/Uninstall.md

@@ -1,76 +1,76 @@
-# Uninstall
+# How to Uninstall SHIELD
 
-This section covers how to uninstall or reset SHIELD's Deploy module infrastructure and outlines common considerations for support and recovery scenarios.
+This guide explains how to fully decommission SHIELD to stop accruing the associated costs. The process involves three steps and an optional step to uninstall SHIELD Desktop. Once you're finished, validate that all the applications and groups have been removed.
 
----
-
-## Uninstalling SHIELD Deploy Infrastructure
-
-The SHIELD platform uses multiple Microsoft 365 services to create configuration components. Removing these components manually is complex and can break your tenant setup. Use the provided uninstall script only if directed by SHI support.
-
-!!! danger "Data Loss Warning"
-    If you uninstall the architecture, **you will clear out any managed objects and configurations** deployed by the Deploy module. This procedure should only be followed if SHI explicitly instructs you to do so.
-
-!!! note "Stateless Server Reminder"
-    SHIELD's application server is stateless. You can safely redeploy the app after cleanup without losing data stored in the Microsoft cloud (e.g., Intune tags, Entra groups).
+!!! note
 
+      To remove Entra groups, Intune scope tags, and Conditional Access policies created by SHIELD, see the SHIELD Deploy [Uninstall Procedure](../Deploy/Reference/Uninstall#uninstall-procedure).
 ---
 
-## Uninstall Procedure
-
-1. **Stop the SHIELD server** to prevent regeneration of infrastructure during cleanup.
+## Step 1: Delete the Azure Resource Group Used for SHIELD
 
-2. **Download the uninstall script**:
+The first decommissioning step is to remove the Azure Resource Group associated with SHIELD.
 
-   📥 [Uninstall-ShieldArchitecture.ps1](../Scripts/Uninstall-ShieldArchitecture.ps1)
+1. Sign in to your Azure portal.
+      - **Enterprise**: [https://portal.azure.com/](https://portal.azure.com/){:target="_blank"}
+      - **Government**: [https://portal.azure.us/](https://portal.azure.us/){:target="_blank"}
+2. Navigate to Subscriptions and select the subscription dedicated to SHIELD.
+3. Click **Resource groups** in the left navigation bar.
+4. Click on the Azure Resource group created for SHIELD (e.g., **SHIELD**).
+5. Click **Delete resource group** at the top of the table and proceed with the deletion process.
 
-3. **Remove all Microsoft.Graph modules** to prevent version conflicts:
+**This removes**:
 
-   ```powershell
-   Get-Module -Name '*Microsoft.Graph*' -ListAvailable | Uninstall-Module
-   ```
+- The **SHIELD Azure App Service** (web app)
+- Associated storage, compute, and networking resources
 
-!!! note
-        You may have to run the above command twice because the order of operations tries to uninstall a dependency first rather than last. Running it the second time will remove the remaining dependency.
-
-1. **Install the correct version of Microsoft Graph Beta modules**:
-
-   ```powershell
-   Install-Module -Name 'Microsoft.Graph.Beta' -RequiredVersion '2.1.0' -Scope 'AllUsers'
-   ```
+---
 
-2. **Run the uninstall script** to remove SHIELD-deployed infrastructure.
+## Step 2: Cancel the Azure Subscription
 
-   The script is designed to remove:
-   - Entra ID groups and admin units
-   - Intune scope tags
-   - Conditional Access policies created by SHIELD
+Once the resource group is removed, the next step is to remove the Azure subscription used for SHIELD. If SHIELD was deployed in its own dedicated Azure subscription, you can go ahead and remove it. If it is running in a shared subscription, this step can be skipped.
 
-   It does **not** delete data outside the SHIELD-deployed infrastructure.
+1. Sign in to your Azure portal.
+      - **Enterprise**: [https://portal.azure.com/](https://portal.azure.com/){:target="_blank"}
+      - **Government**: [https://portal.azure.us/](https://portal.azure.us/){:target="_blank"}
+2. Navigate to **Subscriptions** and select the subscription dedicated to SHIELD.
+3. Click **Cancel subscription** at the top of the table and proceed with the cancelation process.
 
 ---
 
-## FAQs & Recovery Notes
+## Step 3: Delete SHIELD Identity Objects in Entra ID
 
-### What if the uninstall script fails?
+After Azure resources are removed, you will need to remove a few identity objects. These objects are created as part of the SHIELD installation process and should be removed to fully decommission access.
 
-Try re-running the script. It is designed to be idempotent and will retry safely. Make sure you have proper permissions and the correct PowerShell modules installed.
+1. Sign in to your Entra ID admin center.
+      - **Enterprise**: [https://entra.microsoft.com/](https://entra.microsoft.com/){:target="_blank"}
+      - **Government**: [https://entra.microsoft.us/](https://entra.microsoft.us/){:target="_blank"}
+2. Navigate to **Enterprise apps** in the navigation bar.
+3. Click on the name of the application you wish to delete. You can use the search bar if needed. You will need to delete the following applications:
+      - **SHIELD - End User Login**
+      - **SHIELD - Desktop**
+      - **SHI - Data Gateway**
+4. Click **Properties** in the left navigation bar.
+5. Click the **Delete** button at the bottom and proceed with the deletion process.
+6. Repeat steps 2-5 until you have deleted all the applications.
 
-### Can I re-deploy SHIELD after uninstalling?
+---
 
-Yes. SHIELD can be redeployed using the same app interface or script, as long as all infrastructure components have been successfully removed.
+## Optional: Uninstall the SHIELD Desktop Application (If installed)
 
-### What is not removed?
+If you installed SHIELD using the SHIELD Desktop application, you can uninstall it after SHIELD Discover is complete. SHIELD Desktop is no longer required after reporting is finalized. This applies whether the app was installed on:
 
-- Audit logs in Entra ID
-- Device enrollment history
-- Local device configurations if not managed via Intune
+- A local machine
+- An Azure VM
 
 ---
 
-## Related Pages
+## Final Step: Validate Cleanup
+
+As a final check, you may want to:
 
-- [Deploy Overview](../Deploy/)
-- [Deploy Usage Guide](../Deploy/Usage-Guide)
-- [Deployment](../Deploy/Deployment/)
-- [Deploy Reference](../Deploy/Reference/)
+- Confirm the SHIELD resource group is fully removed
+- Confirm the SHIELD web app no longer exists in Azure App Services
+- Confirm the Azure Subscription dedicated for SHIELD has been canceled
+- Confirm there are no SHIELD‑related applications in Entra ID
+- Confirm the SHIELD Desktop application has been uninstalled

requirements.txt

@@ -1 +1 @@
-zensical == 0.0.56
+zensical == 0.0.60