PS5 implicit remoting

[rberghuis]

PS5 implicit remoting does not support auto-loading of nested modules, so we need to explicitly import the required nested modules for AIPService with -UseWindowsPowerShell to ensure they are loaded in the WinPS5 session, as Connect-ZtAssessment is run from PS7.

[Copilot]

Pull request overview

This PR updates Connect-ZtAssessment’s Azure Information Protection (AipService) module-loading logic to make Windows PowerShell 5.1 implicit remoting more reliable when the AipService module is installed outside the Windows PowerShell module path (e.g., under the PowerShell 7 module locations).

Changes:

• Import the AipService module via its resolved manifest file path ($_.Path) rather than piping the module object to Import-Module.
• Add inline rationale explaining why a full manifest path is required for WinPS5 implicit remoting in this scenario.

[alexandair]

@rberghuis Have you experienced an error?
ZeroTrustAssessment module doesn't import its required modules from PS7 or PS5 module path. It stores all dependencies in $env:APPDATA\ZeroTrustAssessment\Modules (on Windows).

[rberghuis]

@alexandair yes, I could load the module itself but populated the below error when trying to do implicit remoting

❯ get-module aipservice -ListAvailable

    Directory: C:\Users\...\Documents\PowerShell\Modules

ModuleType Version    PreRelease Name                                PSEdition ExportedCommands
---------- -------    ---------- ----                                --------- ----------------
Manifest   3.0.0.1               AIPService                          Desk      {...}

❯ cd C:\Users\robbert.berghuis\src\zerotrustassessment\src\powershell
❯ import-module .\ZeroTrustAssessment.psd1

Resolving 7 dependencies...
    ✅ Module PSFramework found (v1.14.450).
    ✅ Module Microsoft.Graph.Authentication found (v2.37.0).
    ✅ Module Microsoft.Graph.Beta.Teams found (v2.37.0).
    ✅ Module Az.Accounts found (v5.5.0).
    ✅ Module ExchangeOnlineManagement found (v3.9.0).
    ✅ Module Microsoft.Online.SharePoint.PowerShell found (v16.0.27313.12000).
    ✅ Module AipService found (v3.0.0.1).


Asserting MSAL loading order for dependencies...
    ✅ Loading Microsoft.IdentityModel.Abstractions.dll
    ✅ Loading MSAL v4.83.1.0 for dependency Az.Accounts version 5.5.0
    ✅ Loaded Microsoft.Identity.Client.Broker.dll
    ✅ Loaded Microsoft.Identity.Client.Extensions.Msal.dll
    ✅ Loaded Microsoft.Identity.Client.NativeInterop.dll
    ✅ Loaded Microsoft.IdentityModel.Abstractions.dll

❯ Connect-ZtAssessment
[...]

Connecting to Azure Information Protection
VERBOSE: [13:46:02][Connect-ZtAssessment] Connecting to Azure Information Protection
VERBOSE: [13:46:02][Connect-ZtAssessment] Loading Azure Information Protection required modules: AIPService
   ❌ Failed to load Azure Information Protection modules.
       Tests requiring Azure Information Protection will be skipped.
       Error details: Failure from remote command: Import-Module -Name 'AIPService': The specified module 'AIPService' was not loaded because no valid module file was found in any module directory.`

[...]

With this fix, it seems to be resolved. Trial-and-error, which is the reason I load the module locally.

[rberghuis]

@alexandair for reference, this is a sanitized transcript

Transcript started, output file is .\pssession.txt

PS>$ErrorActionPreference = "stop"
PS>$verbosePreference = "Continue"
PS>connect-ZtAssessment
VERBOSE: === Initialize-Dependencies.ps1 Starting ===
VERBOSE: Setting C:\Users\...\Documents\PowerShell\Modules;C:\Program Files\PowerShell\Modules;c:\program files\windowsapps\microsoft.powershell_7.6.3.0_x64__8wekyb3d8bbwe\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\Microsoft Purview Information Protection\Powershell to include the C:\Users\...\AppData\Roaming\ZeroTrustAssessment\Modules for module dependencies...
VERBOSE: RequiredModulesPath path already exists: C:\Users\...\AppData\Roaming\ZeroTrustAssessment\Modules
VERBOSE: Updating PSModulePath to include C:\Users\...\AppData\Roaming\ZeroTrustAssessment\Modules...

Resolving 7 dependencies...
<< omitted >>
VERBOSE: Saving module AipService with version 3.0.0.1...
VERBOSE: Populating RepositorySourceLocation property for module AIPService.
VERBOSE: Loading module from path 'C:\Users\...\Documents\PowerShell\Modules\AIPService\3.0.0.1\AadrmAliases.psm1'.
VERBOSE: Loading module from path 'C:\Users\...\Documents\PowerShell\Modules\AIPService\3.0.0.1\AipService.psd1'.
VERBOSE: Populating RepositorySourceLocation property for module AipService.
VERBOSE: Loading module from path 'C:\Users\...\Documents\PowerShell\Modules\AIPService\3.0.0.1\AadrmAliases.psm1'.
VERBOSE: Loading module from path 'C:\Users\...\Documents\PowerShell\Modules\AIPService\3.0.0.1\AipService.dll'.
    ✅ Module AipService found (v3.0.0.1).
<< omitted >>
VERBOSE: Populating RepositorySourceLocation property for module AIPService.
VERBOSE: Loading module from path 'C:\Users\...\Documents\PowerShell\Modules\AIPService\3.0.0.1\AadrmAliases.psm1'.
VERBOSE: Loading module from path 'C:\Users\...\Documents\PowerShell\Modules\AIPService\3.0.0.1\AipService.psd1'.
VERBOSE: Populating RepositorySourceLocation property for module AipService.
VERBOSE: Loading module from path 'C:\Users\...\Documents\PowerShell\Modules\AIPService\3.0.0.1\AadrmAliases.psm1'.
VERBOSE: Loading module from path 'C:\Users\...\Documents\PowerShell\Modules\AIPService\3.0.0.1\AipService.dll'.
<< omitted >>
VERBOSE: Populating RepositorySourceLocation property for module AIPService.
VERBOSE: Loading module from path 'C:\Users\...\Documents\PowerShell\Modules\AIPService\3.0.0.1\AadrmAliases.psm1'.
VERBOSE: Loading module from path 'C:\Users\...\Documents\PowerShell\Modules\AIPService\3.0.0.1\AipService.psd1'.
VERBOSE: Populating RepositorySourceLocation property for module AipService.
VERBOSE: Loading module from path 'C:\Users\...\Documents\PowerShell\Modules\AIPService\3.0.0.1\AadrmAliases.psm1'.
VERBOSE: Loading module from path 'C:\Users\...\Documents\PowerShell\Modules\AIPService\3.0.0.1\AipService.dll'.
<< omitted >>
VERBOSE: Loading MSAL v4.57.0.0 for dependency AIPService version 3.0.0.1
VERBOSE: MSAL v4.57.0.0 is already loaded, skipping.
<< omitted >>
VERBOSE: Resolving required modules for service 'AipService'.
VERBOSE: Resolving required module '@{ ModuleName = 'AipService'; Guid = '{e338ccc0-3333-4479-87fe-66382d33782d}' ; ModuleVersion = '3.0.0.1' }' for service 'AipService'.
VERBOSE: Populating RepositorySourceLocation property for module AIPService.
VERBOSE: Loading module from path 'C:\Users\...\Documents\PowerShell\Modules\AIPService\3.0.0.1\AadrmAliases.psm1'.
VERBOSE: Loading module from path 'C:\Users\...\Documents\PowerShell\Modules\AIPService\3.0.0.1\AipService.psd1'.
VERBOSE: Populating RepositorySourceLocation property for module AipService.
VERBOSE: Loading module from path 'C:\Users\...\Documents\PowerShell\Modules\AIPService\3.0.0.1\AadrmAliases.psm1'.
VERBOSE: Loading module from path 'C:\Users\...\Documents\PowerShell\Modules\AIPService\3.0.0.1\AipService.dll'.
VERBOSE: Module 'AipService' is available with version v3.0.0.1.

<< omitted >>

🔑 Authentication to Graph, Azure, AipService, ExchangeOnline, SecurityCompliance, SharePointOnline.
During the next steps, you may be prompted to authenticate separately for several services.

<< omitted >>

   ✅ Already connected.

Connecting to Azure Information Protection
VERBOSE: [13:44:26][Connect-ZtAssessment] Connecting to Azure Information Protection
VERBOSE: [13:44:26][Connect-ZtAssessment] Loading Azure Information Protection required modules: AIPService
PS>TerminatingError(Import-Module): "The running command stopped because the preference variable "ErrorActionPreference" or common parameter is set to Stop: Failure from remote command: Import-Module -Name 'AIPService': The specified module 'AIPService' was not loaded because no valid module file was found in any module directory."
   ❌ Failed to load Azure Information Protection modules.
       Tests requiring Azure Information Protection will be skipped.
       Error details: Failure from remote command: Import-Module -Name 'AIPService': The specified module 'AIPService' was not loaded because no valid module file was found in any module directory.

Connecting to SharePoint Online
VERBOSE: [13:44:27][Connect-ZtAssessment] Loading SharePoint Online required modules: Microsoft.Online.SharePoint.PowerShell
PS>TerminatingError(): "The pipeline has been stopped."

PS>$error[0]
Import-Module: C:\Users\...\Documents\PowerShell\Modules\ZeroTrustAssessment\2.4.0\public\Connect-ZtAssessment.ps1:458
Line |
 458 |  …        $_ | Import-Module -Global -ErrorAction Stop -PassThru -UseWin …
     |                ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Failure from remote command: Import-Module -Name 'AIPService': The specified module 'AIPService' was not loaded because no valid module file was found in any module directory.

PS>stop-transcript

[alexandair]

I need to investigate why it fails for Connect-ZtAssessment, but it's correctly found for Import-Module zerotrustassessment.

C:\Users\...\Documents\PowerShell\Modules as an output of get-module aipservice -ListAvailable doesn't tell us anything about ZeroTrustAssessment module, because we save AIPService module (together with other required modules) to custom location and modify PSModulePath so that we can find and import them.

Out of curiosity, why did you install AIPService to PS7 module path when it's not supported to run directly in PS7?

Did you run ZTA-related commands in a fresh PowerShell session?