CLI 6.43.0

[6.43.0] - 2026-08-31

Added

• JCAM: jcam dry_run now follows POA&Ms to their milestones, so the milestone mapping can be
  checked before an import rather than only by importing and looking. It samples a few POA&Ms
  per system by default, since a dry run proves the mapping rather than enumerating the data;
  --limit 0 follows every one. When the sampled POA&Ms carry no milestones it says so, rather
  than leaving an empty result that reads the same as a mapping which produced nothing.
• Configurable JCAM field mapping. Where each JCAM value lands in RegScale is expressed as a mapping profile rather than hard-coded, so a tenant whose custom fields are named or arranged differently is served by configuration instead of a release. Two profiles ship: legacy reproduces the previous behaviour for existing tenants, and modern is the recommended layout for new ones. A new jcam dry_run command shows what an import would write, without writing it
• Interactive terminal GUI in beta (regscale gui / regscale tui) for browsing, configuring, and running CLI commands with searchable autocomplete pickers for RegScale records, live console output, and run history

Changed

• JCAM: jcam dry_run --verbose now states, for each destination it would write, whether the
  field is custom or native, which of its names matched, and the label a user sees for it in
  the UI. A field name on its own could not answer "did this land in the right field", since
  RegScale carries three names per field and calls two of them the same thing.
• Legacy Azure AD sync commands sync_admins, sync_general, and sync_readonly replaced by sync_app and sync_tenant_admins, with removal stubs that name the replacement command and warn where it is not a drop-in and requires App and AppGroup setup first
• Legacy Azure AD ad* configuration keys are deprecated in favor of azureEntraClientId, azureEntraSecret, and azureEntraTenantId but are still applied for one release cycle, so an existing init.yaml keeps working while a warning names the rename each command needs
• Azure AD/Entra synchronization redesigned for App Management IAM model with per-App and tenant-admin sync commands

Fixed

• JCAM: jcam check_custom_fields now also reports what the configured mapping profile cannot
  resolve against the tenant. It previously checked only the field lists the importers name,
  so a tenant could be told it was fully configured and still have its import refused for a
  field the profile needs but no importer constant mentions.
• JCAM: a value the profile refuses to translate now fails that record and is recorded in the
  run report, instead of ending the whole import with a traceback. It was raised as a plain
  RuntimeError, which none of the per-record handlers caught.
• JCAM: a mapping profile that cannot resolve, or configuration naming something that does not
  exist, now reports its message and exits non-zero instead of ending the command with a
  traceback. The message was already actionable; the stack around it was not.
• JCAM: a jcamValueMapping override on a source translated by a mapper is now refused rather
  than silently replacing the mapper with a static dictionary, which lost a lookup that
  consults the tenant and turned every unlisted value into a failed import. A sparse override
  on a plain source now leaves values it does not name alone rather than treating them as
  errors, and everything an override produces is validated the way the shipped profiles are.
• JCAM interconnection descriptions are saved. They were passed to a field name the model does not have, and unknown fields are ignored rather than rejected, so every interconnection imported from JCAM was created without a description
• JCAM points of contact whose position name carries surrounding whitespace now reach their RegScale role or custom field instead of being silently discarded
• JCAM import no longer fails when a cloud attribute has no value, and milestone notes preserve an absent value instead of recording the text "None"
• Azure AD sync reports and lock files now honor the configured artifacts directory instead of always writing to a relative artifacts folder
• Tag filtering no longer silently drops matching AWS networking resources for Direct Connect, Transit Gateway, VPN, Global Accelerator, Network Firewall, and Route53 Resolver