feat: release v2.1.0 - MG display names, duplicate suppression, activation-window visibility, PSGallery import notification, deactivation safety (thanks @l-gosling)

What's included

- Management group scopes show friendly names (or / for tenant root)
- Suppress subscription-level inherited eligible duplicates when MG-level eligible exists
- Enrich tenant-root/MG active assignments with activation Start/End (temporary activations visible)
- Normalize RoleDefinitionId to GUID for reliable deduplication
- Import-time PSGallery version notification (opt-out via $script:SuppressUpdateNotification)
- Community fix: Scope-aware activation/deactivation and safer deactivation (thanks @l-gosling)

Author: Noble-Effeciency13

CHANGELOG.md

@@ -12,6 +12,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Scheduling**: Plan role activations for future times
 - **Enhanced Reporting**: Built-in activation history and analytics
 
+---
+
+## [2.1.0] - 2026-01-27
+
+### ✅ Enhancements
+- Management group display names: management-group scopes are now presented with friendly display names (or `/` for tenant root) instead of raw management-group IDs.
+- Suppress inherited eligible duplicates: subscription-scoped inherited eligible roles are now suppressed when the same role is available at the management-group level to avoid duplicate activation entries.
+- Temporary activation visibility: tenant-root and management-group active assignments are enriched with PIM activation Start/End windows so temporary activations show expiry rather than appearing permanently active.
+- Role definition normalization: normalize role definition identifiers to GUIDs during de-duplication to prevent duplicates caused by full-path vs GUID variants.
+- Import-time PSGallery notification: module import performs a best-effort PSGallery check and emits a Microsoft-style warning when a newer release is available (opt-out via `$script:SuppressUpdateNotification`).
+
+### 🛠️ Fixes
+- Activation/Deactivation Scope and Safety: Added explicit `Scope` support for activation/deactivation operations and improved error handling to prevent attempting to deactivate roles that have been activated for less than the required 5-minute grace period. (Thanks to Lukas Gosling (@l-gosling) for this contribution.)
+
+### Notes
+- These are additive fixes and enhancements focused on Azure resource role display, de-duplication, and temporary activation handling.
+
+
 ---
 
 ## [2.0.0] - 2025-12-29

PIMActivation.psd1

@@ -3,7 +3,7 @@
     RootModule           = 'PIMActivation.psm1'
 
     # Version number of this module.
-    ModuleVersion        = '2.0.0'
+    ModuleVersion        = '2.1.0'
 
     # Supported PSEditions - Requires PowerShell Core (7+)
     CompatiblePSEditions = @('Core')
@@ -62,49 +62,22 @@
             # A URL to an icon representing this module.
             IconUri                  = 'https://raw.githubusercontent.com/Noble-Effeciency13/PIMActivation/main/Resources/icon.png'
 
-            # ReleaseNotes
-            ReleaseNotes             = @'
-## PIMActivation v2.0.0 - Azure Resources & Parallel Processing Engine
+                        # ReleaseNotes
+                        ReleaseNotes             = @'
+## PIMActivation v2.1.0 - Patch & Enhancements
 
-### 🚀 Major New Features
-- **Azure Resource Roles Support**: Full integration with Azure Resource PIM for subscription, resource group, and individual resource role management
-- **Parallel Processing Engine**: High-performance concurrent execution for all operations with real-time progress tracking
-- **Enhanced Role Display**: Azure roles display with [Azure] prefix and portal-aligned resource/scope columns
-- **Cross-Subscription Support**: Automatic enumeration and management across all accessible Azure subscriptions
-- **Modular Architecture**: Split functions into individual files for better maintainability
+### ✅ Enhancements
+- Management group display names: management-group scopes are now shown with their friendly display name (or `/` for tenant root) instead of raw MG IDs.
+- Inherited eligible role suppression: subscription-scoped inherited eligible roles are suppressed when the same role is available at the management-group level to avoid duplicate activation entries.
+- Temporary activation detection: initial tenant-root and management-group active assignments are enriched with PIM activation schedule Start/End windows so temporarily activated roles show expiry rather than appearing permanently active.
+- Role definition normalization: role definition identifiers are normalized (GUID) during deduplication to eliminate duplicates caused by full-path vs GUID variants.
+- Import-time PSGallery notification: on import the module performs a best-effort check against the PowerShell Gallery and warns when a newer release is available. The notification follows Microsoft module style and provides Update-Module / Install-Module examples. This check can be suppressed via `$script:SuppressUpdateNotification`.
 
-### ⚡ Performance Features
-- **Parallel Processing by Default**: Concurrent execution for Azure, Entra, and Group operations
-- **Real-Time Progress Tracking**: Enhanced verbose output with emoji indicators (🚀, ✅, ❌) and timing metrics
-- **Smart Throttling**: Default ThrottleLimit of 10 concurrent operations, configurable up to 50
-- **Thread-Safe Operations**: ConcurrentBag and ConcurrentDictionary for safe parallel result aggregation
+### 🛠️ Fixes (Community Contribution)
+- Activation/Deactivation Scope and Safety: Added explicit `Scope` support when activating and deactivating Azure PIM roles and improved error handling to prevent attempting to deactivate a role that was activated less than the required 5-minute window. (Thanks to Lukas Gosling (@l-gosling) for this contribution.)
 
-### ✅ Added
-- Complete Azure Resource role activation and deactivation support
-- Select All button for bulk role selection in GUI
-- `Get-AzureResourceRoles` function with parallel subscription processing
-- `Initialize-AzureResourceSupport` for Azure module management
-- `DisableParallelProcessing` parameter for sequential processing when needed
-- Enhanced scope parsing for Azure ARM resource hierarchies
-- Support for both PIM-eligible and active Azure Resource role assignments
-
-### 🔧 Enhanced Performance
-- All v1.2.x optimizations preserved and extended:
-  - ArrayList-based collections for optimal memory usage
-  - Batch API operations reducing Graph calls by 85%
-  - Memoized scope display name lookups
-  - Intelligent role deduplication and caching
-  - NEW: Parallel processing across all role types and policy operations
-
-### 📋 Requirements
-- PowerShell 7.0+ (required for parallel processing engine)
-- Az.Accounts 5.1.0+ and Az.Resources 6.0.0+ (auto-installed for Azure resources)
-- Microsoft Graph PowerShell modules (existing requirements preserved)
-
-### 📚 More
-- Changelog: https://github.com/Noble-Effeciency13/PIMActivation/blob/main/CHANGELOG.md
-- Blog Post: https://www.chanceofsecurity.com/post/microsoft-entra-pim-bulk-role-activation-tool
-- Releases:  https://github.com/Noble-Effeciency13/PIMActivation/releases
+### ⚡ Notes
+- These changes are additive and preserve existing public APIs. They improve display fidelity and de-duplication for Azure resource roles and make temporary activations visible as such in the UI.
 
 PowerShell module for comprehensive PIM role management across Entra ID, Groups, and Azure Resources with parallel processing engine and modern GUI.
 '@

PIMActivation.psm1

@@ -27,6 +27,9 @@ $script:IncludeAzureResources = $false
 # Startup parameters (for restarts)
 $script:StartupParameters = @{}
 
+# Control runtime update-notification behavior. Can be set by consumers to suppress the PSGallery check.
+$script:SuppressUpdateNotification = $false
+
 # Restart flag
 $script:RestartRequested = $false
 
@@ -77,8 +80,6 @@ $script:RequiredModuleVersions = @{
     'Microsoft.Graph.Identity.Governance'          = '2.29.0'
     'Microsoft.Graph.Groups'                       = '2.29.0'
     'Microsoft.Graph.Identity.SignIns'             = '2.29.0'
-#    'Az.Accounts'                                  = '5.1.0'
-#    'Az.Resources'                                 = '6.0.0'
 }
 
 #endregion Module Setup
@@ -158,11 +159,54 @@ $script:DependenciesValidated = $false
 Write-Verbose "PIMActivation module loaded. Use Start-PIMActivation to begin."
 Write-Verbose "Dependencies will be validated and installed automatically when needed."
 
+# Check PowerShell Gallery for newer module version and notify on import (best-effort)
+try {
+    if (-not $script:SuppressUpdateNotification) {
+        if (Get-Command -Name Find-Module -Module PowerShellGet -ErrorAction SilentlyContinue) {
+            try {
+                $remote = Find-Module -Name $script:ModuleName -Repository PSGallery -ErrorAction SilentlyContinue
+                if ($remote -and $remote.Version) {
+                    $localVersion = $null
+                    try {
+                        $manifest = Join-Path $script:ModuleRoot "$($script:ModuleName).psd1"
+                        if (Test-Path $manifest) {
+                            $md = Import-PowerShellDataFile -Path $manifest
+                            $localVersion = [Version]($md.ModuleVersion)
+                        }
+                    } catch {}
+
+                    if (-not $localVersion) {
+                        # Fallback to module manifest discovery
+                        $localVersion = [Version]('0.0.0')
+                    }
+
+                    $remoteVersion = [Version]($remote.Version.ToString())
+                    if ($remoteVersion -gt $localVersion) {
+                        $psgalleryUrl = "https://www.powershellgallery.com/packages/$($script:ModuleName)/$($remoteVersion)"
+                        $msg = @()
+                        $msg += "A newer version of the module '$($script:ModuleName)' is available on the PowerShell Gallery."
+                        $msg += "Installed version: $localVersion"
+                        $msg += "Latest version:    $remoteVersion"
+                        $msg += "To update this module, run:     Update-Module -Name $($script:ModuleName) -Force"
+                        $msg += "If Update-Module is unavailable, you can install the latest version with: Install-Module -Name $($script:ModuleName) -Force"
+                        $msg += "More information: $psgalleryUrl"
+                        Write-Warning ($msg -join "`n")
+                    }
+                }
+            } catch {
+                Write-Verbose "PSGallery version check failed: $($_.Exception.Message)"
+            }
+        }
+    }
+} catch {
+    Write-Verbose "Update notification check encountered an error: $($_.Exception.Message)"
+}
 #endregion Module Initialization
 
 #region Cleanup
 
 # Clean up variables
 Remove-Variable -Name Private, Public, functionFolders, folder, folderPath, functions, function, privateRoot, import -ErrorAction SilentlyContinue
 
-#endregion Cleanup
+
+#endregion Cleanup