diff --git a/.github/scripts/Test-RepoSanitized.ps1 b/.github/scripts/Test-RepoSanitized.ps1
index 2edf3de..3efdded 100644
--- a/.github/scripts/Test-RepoSanitized.ps1
+++ b/.github/scripts/Test-RepoSanitized.ps1
@@ -107,11 +107,7 @@ $placeholderDomains = @(
 )
 $placeholderTenantLabels = @(
     'contoso', 'fabrikam', 'tenant', 'tenantname', 'yourtenant', 'your-tenant', 'mytenant',
-    'example', 'yourorg', 'org', 'company', 'yourcompany', 'tenantid', 'tenant-name'
-)
-$placeholderLocalParts = @(
-    'user', 'username', 'admin', 'someone', 'name', 'upn', 'firstname.lastname',
-    'first.last', 'john.doe', 'jane.doe', 'jdoe', 'you', 'me', 'noreply', 'no-reply'
+    'example', 'yourorg', 'org', 'company', 'yourcompany', 'tenantid', 'tenant-name', 'label'
 )
 
 #endregion Configuration
@@ -223,7 +219,8 @@ $rules = @(
     },
     @{
         Name     = 'SecretAssignment'
-        Pattern  = '(?i)\b(?<key>client[_-]?secret|app[_-]?secret|api[_-]?key|access[_-]?token|refresh[_-]?token|sas[_-]?token|account[_-]?key|connection[_-]?string|password|passwd|pwd)\b\s*[:=]\s*["'']?(?<v>[^\s"''`,;]{12,})'
+        # Matches  key = value,  key: value  and the JSON form  "key": "value".
+        Pattern  = '(?i)\b(?<key>client[_-]?secret|app[_-]?secret|api[_-]?key|access[_-]?token|refresh[_-]?token|sas[_-]?token|account[_-]?key|connection[_-]?string|password|passwd|pwd|pre[_-]?shared[_-]?key|shared[_-]?secret|proxy[_-]?password|passphrase|psk)\b["'']?\s*[:=]\s*["'']?(?<v>[^\s"''`,;]{12,})'
         Scope    = $null
         Message  = 'Secret assigned as a literal value. Use a placeholder and document the app registration / Key Vault pattern instead.'
         Validate = { param($m) -not (Test-IsPlaceholderValue $m.Groups['v'].Value) }
@@ -243,26 +240,30 @@ $rules = @(
     },
     @{
         Name     = 'TenantDomain'
-        Pattern  = '(?i)\b(?<label>[a-z0-9-]+)\.onmicrosoft\.com\b'
+        # The optional .mail segment is consumed so that the real label is what gets checked, and a
+        # match may not start right after '.' or '>' (so <TENANT>.mail.onmicrosoft.com is not flagged).
+        Pattern  = '(?i)(?<![\p{L}\p{N}.>-])(?<label>[a-z0-9-]+)(?:\.mail)?\.onmicrosoft\.com\b'
         Scope    = $null
         Message  = 'Real tenant domain. Use contoso.onmicrosoft.com or <TENANT>.onmicrosoft.com.'
         Validate = { param($m) -not ($placeholderTenantLabels -contains $m.Groups['label'].Value.ToLowerInvariant()) }
     },
     @{
         Name     = 'EmailOrUpn'
-        Pattern  = '\b(?<local>[A-Za-z0-9._%+-]+)@(?<domain>[A-Za-z0-9.-]+\.[A-Za-z]{2,})\b'
+        # Also matches guest UPNs (name_domain.com#EXT#@tenant), %40-encoded and non-ASCII local parts.
+        Pattern  = '(?<local>[\p{L}\p{N}._%+''#-]+)(?:@|%40)(?<domain>[A-Za-z0-9.-]+\.[A-Za-z]{2,})(?![\p{L}\p{N}-])'
         Scope    = $null
         Message  = 'E-mail address / UPN that is not a documented placeholder domain. Use user@contoso.com.'
         Validate = {
             param($m)
+            # JSON keys such as definition@odata.bind are not addresses.
+            if ($m.Groups['domain'].Value -like 'odata.*') { return $false }
             if (Test-IsPlaceholderDomain $m.Groups['domain'].Value) { return $false }
-            if ($placeholderLocalParts -contains $m.Groups['local'].Value.ToLowerInvariant()) { return $false }
             return $true
         }
     },
     @{
         Name     = 'TenantObjectIdInJson'
-        Pattern  = '"(?<key>tenantId|tenantid|groupId|targetGroupId|azureADDeviceId|azureAdDeviceId|aadDeviceId|deviceId|managedDeviceId|intuneDeviceId|entraDeviceId|userId|enrolledByUserId|roleScopeTagId|filterId|deviceAndAppManagementAssignmentFilterId)"\s*:\s*"(?<v>[^"]*)"'
+        Pattern  = '"(?<key>tenantId|tenantid|groupId|targetGroupId|azureADDeviceId|azureAdDeviceId|azureActiveDirectoryDeviceId|aadDeviceId|deviceId|managedDeviceId|intuneDeviceId|entraDeviceId|userId|enrolledByUserId|ownerId|principalId|createdByUserId|sourceId|roleScopeTagId|filterId|assignmentFilterId|deviceAndAppManagementAssignmentFilterId|notificationTemplateId|secretReferenceValueId)"\s*:\s*"(?<v>[^"]*)"'
         Scope    = $null
         Message  = 'Tenant-specific object ID in a known key. Replace with a placeholder such as <GROUP-OBJECT-ID> and note what goes there in the doc.'
         Validate = {
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 5bdb333..1d34785 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -58,7 +58,12 @@ Exports from the admin center and Graph contain tenant IDs, group object IDs, ti
 | `<CLIENT-ID>`                  | App registration (client) ID                                      |
 | `<CERT-THUMBPRINT>`            | Certificate thumbprint for app-only auth                          |
 | `<UPN>` or `user@contoso.com`  | A user principal name                                             |
+| `<USER-DISPLAY-NAME>`          | A person's display name                                           |
 | `<DEVICE-NAME>`, `<SERIAL>`    | Device identifiers                                                |
+| `<HARDWARE-HASH>`, `<MAC-ADDRESS>`, `<IMEI>` | Device identifiers that are secrets                  |
+| `<SECRET>`                     | Any password, pre-shared key, token, or secret setting value      |
+| `<HOSTNAME>`, `<SERVER>`, `<IP-ADDRESS>` | Internal hostnames, UNC hosts, private IP addresses      |
+| `<BASE64-BLOB-REMOVED:n-CHARS>` | A certificate, payload, or other binary blob that was removed    |
 
 Never commit, even in history: tokens, client secrets, private keys, Autopilot hardware hashes, serial numbers, IMEIs, MAC addresses, real UPNs, internal hostnames, or employee IDs. If you realize you pushed one, rotate it first, then tell the maintainer.
 
diff --git a/scripts/powershell/ConvertTo-SanitizedIntuneExport.ps1 b/scripts/powershell/ConvertTo-SanitizedIntuneExport.ps1
index 48852fb..3979cb9 100644
--- a/scripts/powershell/ConvertTo-SanitizedIntuneExport.ps1
+++ b/scripts/powershell/ConvertTo-SanitizedIntuneExport.ps1
@@ -5,37 +5,58 @@
 
 .DESCRIPTION
     Takes one or more JSON files (or folders of JSON files) exported from the Intune admin center
-    ("Export JSON" on a Settings Catalog profile) or from Microsoft Graph, and writes sanitized copies:
-
-      Removed everywhere      createdDateTime, lastModifiedDateTime, modifiedDateTime, version,
-                              supportsScopeTags, settingCount, priorityMetaData, isAssigned, createdBy,
-                              lastModifiedBy, @odata.context, *@odata.count, *@odata.nextLink
-      Removed when a GUID     id   (object ids are tenant-specific; setting ids like "0" are kept)
-      Replaced                groupId / targetGroupId        -> <GROUP:Display Name> or <GROUP-OBJECT-ID>
-                              deviceAndAppManagementAssignmentFilterId -> <FILTER:Display Name> or <FILTER-ID>
-                              tenantId                        -> <TENANT-ID>
-                              userId, enrolledByUserId        -> <USER-OBJECT-ID>
-                              deviceId, azureADDeviceId, managedDeviceId, ... -> <DEVICE-ID>
-                              userPrincipalName, emailAddress -> <UPN>
-                              serialNumber, hardwareIdentifier, imei, meid, MAC addresses, phoneNumber,
-                              iccid, udid                     -> <SERIAL>, <HARDWARE-HASH>, <IMEI>, ...
-      Replaced inside any string   the tenant GUID given with -TenantId -> <TENANT-ID>
-                                   e-mail addresses that are not documentation placeholders -> <UPN>
-                                   <label>.onmicrosoft.com that is not a placeholder -> <TENANT>.onmicrosoft.com
-      Kept                    displayName, description, settingDefinitionId, templateReference,
-                              settingInstanceTemplateReference, roleScopeTagIds, and every setting value
-
-    Keys are sorted recursively and the JSON is written with 2-space indentation, LF line endings and
-    UTF-8 without BOM, so two exports of the same policy produce a readable git diff.
-
-    The script works entirely offline. It never connects to Graph. The optional name map file lets
+    ("Export JSON" on a Settings Catalog profile) or from Microsoft Graph, and writes sanitized copies.
+
+    Removed everywhere
+        createdDateTime, lastModifiedDateTime, modifiedDateTime, version, supportsScopeTags,
+        settingCount, priorityMetaData, isAssigned, createdBy, lastModifiedBy, sourceId, physicalIds,
+        every *@odata.context, *@odata.count, *@odata.nextLink, *@odata.deltaLink annotation
+    Removed when they identify a tenant object
+        id when its value is a GUID or contains one (policy ids, assignment ids such as
+        <policyId>_<groupId>, enrollment configuration ids such as <tenantId>_Default...).
+        Ids of ADMX definitions, presentations and categories are kept: they are global and an
+        import needs them.
+    Replaced with typed placeholders (see CONTRIBUTING.md)
+        groupId, targetGroupId, notificationMessageCCList, *group* ids   -> <GROUP:Display Name> or <GROUP-OBJECT-ID>
+        deviceAndAppManagementAssignmentFilterId, filterId              -> <FILTER:Display Name> or <FILTER-ID>
+        tenantId                                                        -> <TENANT-ID>
+        userId, ownerId, principalId, *user* ids                        -> <USER-OBJECT-ID>
+        deviceId, azureADDeviceId, managedDeviceId, *device* ids        -> <DEVICE-ID>
+        other *Id keys holding a GUID (apps, policies, templates that are tenant objects) -> <APP-ID>, <POLICY-ID>, <OBJECT-ID>
+        userPrincipalName, emailAddress                                 -> <UPN>
+        userDisplayName, userName, addressableUserName                  -> <USER-DISPLAY-NAME>
+        deviceName, managedDeviceName, computerName, hostName           -> <DEVICE-NAME>
+        serialNumber, serial, serialNumbers, deviceSerialNumber         -> <SERIAL>
+        hardwareIdentifier, hardwareHash, deviceHardwareData            -> <HARDWARE-HASH>
+        imei, meid, MAC addresses, phoneNumber, iccid, udid, productKey, thumbprint -> <IMEI>, <MEID>, <MAC-ADDRESS>, ...
+        password, preSharedKey, sharedSecret, clientSecret, apiKey, *Token, *Secret, *Passphrase, psk,
+        any value of a *SecretSettingValue, any omaSetting value with isEncrypted = true -> <SECRET>
+        secretReferenceValueId                                          -> <SECRET-REFERENCE-ID>
+        payload, certificate data and any base64 blob of 200+ characters -> <BASE64-BLOB-REMOVED:n-CHARS>
+    Replaced inside any string value (and inside object keys)
+        the tenant GUID(s): from -TenantId and from every tenantId key in the file, dashed or not -> <TENANT-ID>
+        e-mail addresses / UPNs that are not documentation placeholders (also guest #EXT# and %40 forms) -> <UPN>
+        <label>.onmicrosoft.com and <label>.mail.onmicrosoft.com         -> <TENANT>.onmicrosoft.com
+        <label>.sharepoint.com, <label>-my.sharepoint.com, /personal/<user> paths -> <TENANT>.sharepoint.com, /personal/<UPN-PATH>
+        /groups/<guid>, /users/<guid>, /directoryObjects/<guid>, /devices/<guid> in URLs -> typed placeholders
+        MAC addresses, \\server UNC hosts, hosts ending in .local/.corp/.internal/.lan, RFC 1918 IPv4 addresses
+    Kept
+        displayName, description, settingDefinitionId, templateReference, settingInstanceTemplateReference,
+        settingValueTemplateReference, roleScopeTagIds, definition@odata.bind, and every ordinary setting value
+
+    Keys are sorted recursively (ordinal) and the JSON is written with 2-space indentation, LF line
+    endings and UTF-8 without BOM by the script's own serializer, so two exports of the same policy
+    produce a readable git diff and the output is identical on Windows PowerShell 5.1 and PowerShell 7.
+    Sanitizing already-sanitized output changes nothing.
+
+    The script works entirely offline. It never connects to Graph. The optional name map lets
     assignments keep a human-readable group or filter name instead of an opaque placeholder:
 
         { "groups": { "<GROUP-OBJECT-ID>": "WIN-Ring-R1" }, "filters": { "<FILTER-ID>": "Corporate Windows" } }
 
-    The result is what the CI sanitization guard (.github/scripts/Test-RepoSanitized.ps1) expects to
-    find under artifacts/. Run the guard after sanitizing; it catches what this script cannot know
-    about, such as an internal hostname in a description.
+    The per-file summary ends with ReviewHints: lines of the output that still contain a GUID or an
+    IPv4 address. Those are usually global ids (ASR rule ids, ADMX definitions) but read them before
+    you commit. The CI guard (.github/scripts/Test-RepoSanitized.ps1) has the final word.
 
 .PARAMETER Path
     One or more JSON files or folders. Folders are searched recursively for *.json. Files that already
@@ -50,16 +71,20 @@
     Overwrite each input file with its sanitized content. Cannot be combined with -OutputPath.
 
 .PARAMETER TenantId
-    The source tenant's GUID. Every occurrence inside any string value is replaced with <TENANT-ID>.
+    The source tenant's GUID. Every occurrence inside any string is replaced with <TENANT-ID>. The
+    script also learns tenant ids from tenantId keys inside each file, so this is optional when the
+    export carries one.
 
 .PARAMETER NameMapPath
-    JSON file with "groups" and/or "filters" objects that map object ids to display names.
+    JSON file with "groups" and/or "filters" objects that map object ids to display names. Names may
+    not contain <, >, quotes, line breaks or an @ sign.
 
 .PARAMETER RemoveProperty
     Additional property names to remove wherever they occur (case-insensitive).
 
 .PARAMETER KeepProperty
-    Property names that must be kept even though the default rules would remove them, e.g. 'version'.
+    Property names that must be kept even though the default rules would remove or replace them,
+    e.g. 'version'. Use with care: the name is matched everywhere in the document.
 
 .PARAMETER RemoveAssignments
     Drop the assignments array entirely instead of replacing the group and filter ids in it.
@@ -83,12 +108,17 @@
     Re-sanitizes everything already committed, in place. Safe to repeat: the output is idempotent.
 
 .NOTES
-    Validated: 2026-10 on PowerShell 7.6 with synthetic exports and Pester tests; not yet run against
-               a real tenant export.
+    Validated: 2026-10 on PowerShell 7.6 with synthetic exports, Pester tests and an adversarial
+               review; not yet run against a real tenant export.
     Run as:    any user, offline. No Graph connection and no modules required.
     Exit code: none. The script throws on bad input so it can be used from other scripts and tests.
-    Known gaps: it cannot recognise an internal hostname or a person's name in free text. Read the
-               output before committing, and let the CI guard have the final word.
+    Known gaps (the script cannot recognise these; read your output):
+               DOMAIN\user account names, employee ids, people's names in display names and
+               descriptions, public hostnames that are not .local/.corp/.internal/.lan, IMEI or
+               serial numbers typed into free text, GUIDs under keys that do not end in Id (the
+               ReviewHints list points at them), base64 blobs under 200 characters.
+    Numbers:   fractional numbers are normalized the way PowerShell 7 parses them (1.0 -> 1,
+               2.50 -> 2.5) so both PowerShell versions write the same bytes.
 #>
 [CmdletBinding(SupportsShouldProcess)]
 param(
@@ -127,34 +157,71 @@ $ErrorActionPreference = 'Stop'
 
 $script:RemovedProperties = @(
     'createdDateTime', 'lastModifiedDateTime', 'modifiedDateTime', 'version', 'supportsScopeTags',
-    'settingCount', 'priorityMetaData', 'isAssigned', 'createdBy', 'lastModifiedBy', '@odata.context'
+    'settingCount', 'priorityMetaData', 'isAssigned', 'createdBy', 'lastModifiedBy', 'sourceId', 'physicalIds'
 )
-$script:RemovedPropertySuffixes = @('@odata.count', '@odata.nextLink', '@odata.deltaLink')
+$script:RemovedPropertySuffixes = @('@odata.context', '@odata.count', '@odata.nextLink', '@odata.deltaLink')
 
-$script:GroupIdKeys = @('groupId', 'targetGroupId')
-$script:FilterIdKeys = @('deviceAndAppManagementAssignmentFilterId')
+# Objects whose id is a global catalog id, not a tenant object. Matched on the parent key or @odata.type.
+$script:GlobalIdParentKeys = @('definition', 'presentation', 'category')
+$script:GlobalIdTypePattern = '(?i)groupPolicy(Definition|Presentation|Category|UploadedDefinitionFile)'
+
+# Keys that end in Id but hold global catalog identifiers; never replaced.
+$script:KeptIdKeys = @(
+    'templateId', 'settingInstanceTemplateId', 'settingValueTemplateId', 'settingDefinitionId', 'definitionId',
+    'presentationId', 'categoryId', 'groupPolicyCategoryId', 'settingInstanceId', 'mobileAppIdentifier',
+    'bundleId', 'packageId', 'productId', 'skuId', 'appStoreId', 'offerId', 'planId', 'vendorId', 'clientId'
+)
+
+$script:GroupIdKeys = @(
+    'groupId', 'targetGroupId', 'notificationMessageCCList', 'groupIds', 'includedGroups', 'excludedGroups',
+    'includeGroups', 'excludeGroups', 'includeGroupIds', 'excludeGroupIds', 'targetedGroupIds', 'targetGroupIds'
+)
+$script:FilterIdKeys = @('deviceAndAppManagementAssignmentFilterId', 'filterId', 'assignmentFilterId')
 
 # Keys whose GUID values become a typed placeholder.
 $script:GuidPlaceholderByKey = @{
-    'tenantId'         = '<TENANT-ID>'
-    'userId'           = '<USER-OBJECT-ID>'
-    'enrolledByUserId' = '<USER-OBJECT-ID>'
-    'deviceId'         = '<DEVICE-ID>'
-    'azureADDeviceId'  = '<DEVICE-ID>'
-    'aadDeviceId'      = '<DEVICE-ID>'
-    'managedDeviceId'  = '<DEVICE-ID>'
-    'intuneDeviceId'   = '<DEVICE-ID>'
-    'entraDeviceId'    = '<DEVICE-ID>'
+    'tenantId'                     = '<TENANT-ID>'
+    'userId'                       = '<USER-OBJECT-ID>'
+    'enrolledByUserId'             = '<USER-OBJECT-ID>'
+    'ownerId'                      = '<USER-OBJECT-ID>'
+    'principalId'                  = '<USER-OBJECT-ID>'
+    'createdByUserId'              = '<USER-OBJECT-ID>'
+    'members'                      = '<OBJECT-ID>'
+    'includeUsers'                 = '<USER-OBJECT-ID>'
+    'excludeUsers'                 = '<USER-OBJECT-ID>'
+    'deviceId'                     = '<DEVICE-ID>'
+    'azureADDeviceId'              = '<DEVICE-ID>'
+    'azureActiveDirectoryDeviceId' = '<DEVICE-ID>'
+    'aadDeviceId'                  = '<DEVICE-ID>'
+    'managedDeviceId'              = '<DEVICE-ID>'
+    'intuneDeviceId'               = '<DEVICE-ID>'
+    'entraDeviceId'                = '<DEVICE-ID>'
+    'notificationTemplateId'       = '<NOTIFICATION-TEMPLATE-ID>'
+    'roleScopeTagId'               = '<ROLE-SCOPE-TAG-ID>'
+    'secretReferenceValueId'       = '<SECRET-REFERENCE-ID>'
 }
 
-# Keys whose non-empty values become a typed placeholder regardless of shape.
+# Keys whose non-empty string values become a typed placeholder regardless of shape.
 $script:ValuePlaceholderByKey = @{
     'userPrincipalName'           = '<UPN>'
     'emailAddress'                = '<UPN>'
     'enrolledByUserPrincipalName' = '<UPN>'
+    'ownerUserPrincipalName'      = '<UPN>'
+    'userDisplayName'             = '<USER-DISPLAY-NAME>'
+    'enrolledByUserDisplayName'   = '<USER-DISPLAY-NAME>'
+    'addressableUserName'         = '<USER-DISPLAY-NAME>'
+    'userName'                    = '<USER-DISPLAY-NAME>'
+    'deviceName'                  = '<DEVICE-NAME>'
+    'managedDeviceName'           = '<DEVICE-NAME>'
+    'computerName'                = '<DEVICE-NAME>'
+    'hostName'                    = '<DEVICE-NAME>'
     'serialNumber'                = '<SERIAL>'
+    'serial'                      = '<SERIAL>'
+    'serialNumbers'               = '<SERIAL>'
+    'deviceSerialNumber'          = '<SERIAL>'
     'hardwareIdentifier'          = '<HARDWARE-HASH>'
     'hardwareHash'                = '<HARDWARE-HASH>'
+    'deviceHardwareData'          = '<HARDWARE-HASH>'
     'imei'                        = '<IMEI>'
     'meid'                        = '<MEID>'
     'wifiMacAddress'              = '<MAC-ADDRESS>'
@@ -163,23 +230,37 @@ $script:ValuePlaceholderByKey = @{
     'phoneNumber'                 = '<PHONE-NUMBER>'
     'iccid'                       = '<ICCID>'
     'udid'                        = '<UDID>'
+    'productKey'                  = '<PRODUCT-KEY>'
+    'thumbprint'                  = '<CERT-THUMBPRINT>'
+    'certificateThumbprint'       = '<CERT-THUMBPRINT>'
+    'secretReferenceValueId'      = '<SECRET-REFERENCE-ID>'
 }
 
+$script:SecretKeys = @(
+    'password', 'passwordValue', 'preSharedKey', 'sharedSecret', 'proxyPassword', 'clientSecret', 'secret',
+    'apiKey', 'accessToken', 'refreshToken', 'bearerToken', 'sasToken', 'connectionString', 'passphrase',
+    'psk', 'privateKey', 'encryptionKey', 'recoveryKey', 'recoveryPassword'
+)
+$script:SecretKeySuffixPattern = '(?i)(password|secret|passphrase|token|apikey|psk)$'
+
+$script:BlobKeys = @(
+    'payload', 'trustedRootCertificate', 'rootCertificate', 'certificate', 'encodedCertificate',
+    'certificateData', 'rawData', 'pfxBlob', 'blob'
+)
+$script:BlobMinLength = 200
+
 $script:GuidPattern = '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$'
+$script:GuidAnywherePattern = '[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}'
 $script:EmptyGuid = '00000000-0000-0000-0000-000000000000'
 
 $script:PlaceholderTenantLabels = @(
     'contoso', 'fabrikam', 'tenant', 'tenantname', 'yourtenant', 'your-tenant', 'mytenant',
-    'example', 'yourorg', 'org', 'company', 'yourcompany', 'tenant-name'
+    'example', 'yourorg', 'org', 'company', 'yourcompany', 'tenant-name', 'label'
 )
 $script:PlaceholderEmailDomains = @(
     'example.com', 'example.org', 'example.net', 'contoso.com', 'fabrikam.com', 'domain.com',
     'yourdomain.com', 'yourcompany.com', 'company.com', 'tenant.com', 'microsoft.com'
 )
-$script:PlaceholderLocalParts = @(
-    'user', 'username', 'admin', 'someone', 'name', 'upn', 'firstname.lastname', 'first.last',
-    'john.doe', 'jane.doe', 'noreply', 'no-reply'
-)
 
 #endregion Rules
 
@@ -193,7 +274,8 @@ function Test-IsGuidValue {
     if ($null -eq $Value) { return $false }
     if ($Value -is [guid]) { return $true }
     if ($Value -isnot [string]) { return $false }
-    return ($Value -match $script:GuidPattern)
+    $v = $Value.Trim().Trim('{', '}')
+    return ($v -match $script:GuidPattern)
 }
 
 function Test-IsPlaceholderText {
@@ -209,20 +291,21 @@ function Test-IsPlaceholderText {
     return $false
 }
 
-function Test-IsPlaceholderEmail {
+function Test-IsPlaceholderDomain {
     [CmdletBinding()]
     [OutputType([bool])]
-    param([string]$LocalPart, [string]$Domain)
+    param([string]$Domain)
 
-    $d = $Domain.ToLowerInvariant()
+    $d = $Domain.ToLowerInvariant().TrimEnd('.')
+    # JSON keys such as definition@odata.bind look like e-mail addresses; they are not.
+    if ($d.StartsWith('odata.')) { return $true }
     if ($script:PlaceholderEmailDomains -contains $d) { return $true }
     foreach ($p in $script:PlaceholderEmailDomains) {
         if ($d.EndsWith('.' + $p)) { return $true }
     }
-    if ($d -match '^(?<label>[a-z0-9-]+)\.onmicrosoft\.com$') {
+    if ($d -match '^(?<label>[a-z0-9-]+)(\.mail)?\.onmicrosoft\.com$') {
         if ($script:PlaceholderTenantLabels -contains $Matches['label']) { return $true }
     }
-    if ($script:PlaceholderLocalParts -contains $LocalPart.ToLowerInvariant()) { return $true }
     return $false
 }
 
@@ -250,8 +333,11 @@ function Initialize-SanitizeContext {
     $filters = @{}
     if ($FilterNames) { foreach ($k in $FilterNames.Keys) { $filters[[string]$k] = [string]$FilterNames[$k] } }
 
+    $tenantIds = New-Object 'System.Collections.Generic.HashSet[string]' ([System.StringComparer]::OrdinalIgnoreCase)
+    if ($TenantId) { [void]$tenantIds.Add($TenantId.Trim().Trim('{', '}')) }
+
     return @{
-        TenantId          = $TenantId
+        TenantIds         = $tenantIds
         Groups            = $groups
         Filters           = $filters
         Remove            = $remove
@@ -270,93 +356,245 @@ function Add-Replacement {
     [void]$Context.Placeholders.Add($Placeholder)
 }
 
+function Add-TenantIdFromObject {
+    # First pass: learn tenant ids from tenantId keys anywhere in the document.
+    [CmdletBinding()]
+    param([AllowNull()][object]$Value, [hashtable]$Context)
+
+    if ($null -eq $Value) { return }
+    if ($Value -is [string]) { return }
+    if (Test-IsObjectLike $Value) {
+        foreach ($pair in (Get-ObjectPair -Object $Value)) {
+            if ($pair.Key -eq 'tenantId' -and (Test-IsGuidValue $pair.Value) -and $pair.Value -ne $script:EmptyGuid) {
+                [void]$Context.TenantIds.Add(([string]$pair.Value).Trim().Trim('{', '}'))
+            } else {
+                Add-TenantIdFromObject -Value $pair.Value -Context $Context
+            }
+        }
+        return
+    }
+    if (Test-IsArrayLike $Value) {
+        foreach ($item in $Value) { Add-TenantIdFromObject -Value $item -Context $Context }
+    }
+}
+
+function Get-TypedGuidPlaceholder {
+    # Placeholder for a GUID under a key the rules do not list explicitly, chosen from the key name.
+    [CmdletBinding()]
+    [OutputType([string])]
+    param([string]$Key)
+
+    if ($Key -match '(?i)group') { return '<GROUP-OBJECT-ID>' }
+    if ($Key -match '(?i)(user|owner|principal|createdby|modifiedby)') { return '<USER-OBJECT-ID>' }
+    if ($Key -match '(?i)device') { return '<DEVICE-ID>' }
+    if ($Key -match '(?i)filter') { return '<FILTER-ID>' }
+    if ($Key -match '(?i)app') { return '<APP-ID>' }
+    if ($Key -match '(?i)(polic|profile|configuration|intent|script|rule|assignment|baseline)') { return '<POLICY-ID>' }
+    return '<OBJECT-ID>'
+}
+
+function Convert-TextRule {
+    # Applies a regex to $Text, replacing each match for which $Test returns $true (or every match
+    # when no $Test is given) with $Replacement (a string, or a scriptblock receiving the match),
+    # and counts replacements.
+    [CmdletBinding()]
+    [OutputType([string])]
+    param(
+        [AllowEmptyString()][string]$Text,
+        [regex]$Regex,
+        [AllowNull()][scriptblock]$Test,
+        [object]$Replacement,
+        [hashtable]$Context
+    )
+
+    $found = $Regex.Matches($Text)
+    if ($found.Count -eq 0) { return $Text }
+    $builder = New-Object System.Text.StringBuilder
+    $last = 0
+    foreach ($m in $found) {
+        [void]$builder.Append($Text.Substring($last, $m.Index - $last))
+        if ($null -eq $Test -or (& $Test $m)) {
+            $replacementText = [string]$Replacement
+            if ($Replacement -is [scriptblock]) { $replacementText = [string](& $Replacement $m) }
+            [void]$builder.Append($replacementText)
+            Add-Replacement -Context $Context -Placeholder ($replacementText -replace '^.*?(<[^>]+>).*$', '$1')
+        } else {
+            [void]$builder.Append($m.Value)
+        }
+        $last = $m.Index + $m.Length
+    }
+    [void]$builder.Append($Text.Substring($last))
+    return $builder.ToString()
+}
+
+function ConvertTo-SanitizedText {
+    # The free-text rules, applied to every string value and every object key.
+    [CmdletBinding()]
+    [OutputType([string])]
+    param([AllowEmptyString()][string]$Value, [hashtable]$Context)
+
+    if ([string]::IsNullOrEmpty($Value)) { return $Value }
+    $result = $Value
+
+    # 1. Tenant GUIDs, dashed (any case) and dash-less.
+    foreach ($tid in $Context.TenantIds) {
+        if ($result.IndexOf($tid, [System.StringComparison]::OrdinalIgnoreCase) -ge 0) {
+            $result = [regex]::Replace($result, [regex]::Escape($tid), '<TENANT-ID>', [System.Text.RegularExpressions.RegexOptions]::IgnoreCase)
+            Add-Replacement -Context $Context -Placeholder '<TENANT-ID>'
+        }
+        $bare = $tid.Replace('-', '')
+        if ($result.IndexOf($bare, [System.StringComparison]::OrdinalIgnoreCase) -ge 0) {
+            $result = [regex]::Replace($result, [regex]::Escape($bare), '<TENANT-ID>', [System.Text.RegularExpressions.RegexOptions]::IgnoreCase)
+            Add-Replacement -Context $Context -Placeholder '<TENANT-ID>'
+        }
+    }
+
+    # 2. E-mail addresses / UPNs, including guest (#EXT#), %40-encoded and non-ASCII forms. Runs before
+    #    the domain rules so user@tenant.onmicrosoft.com is replaced as a whole.
+    $result = Convert-TextRule -Text $result -Context $Context `
+        -Regex ([regex]'(?<local>[\p{L}\p{N}._%+''#-]+)(?:@|%40)(?<domain>[A-Za-z0-9.-]+\.[A-Za-z]{2,})(?![\p{L}\p{N}-])') `
+        -Test { param($m) -not (Test-IsPlaceholderDomain $m.Groups['domain'].Value) } `
+        -Replacement '<UPN>'
+
+    # 3. Tenant domains: label.onmicrosoft.com and label.mail.onmicrosoft.com.
+    $result = Convert-TextRule -Text $result -Context $Context `
+        -Regex ([regex]'(?i)(?<![\p{L}\p{N}.>-])(?<label>[a-z0-9][a-z0-9-]*)(?<mail>\.mail)?\.onmicrosoft\.com\b') `
+        -Test { param($m) -not ($script:PlaceholderTenantLabels -contains $m.Groups['label'].Value.ToLowerInvariant()) } `
+        -Replacement '<TENANT>.onmicrosoft.com'
+
+    # 4. SharePoint hosts and personal-site paths.
+    $sharePointReplacement = { param($m) '<TENANT>' + $m.Groups['suffix'].Value + '.sharepoint.com' }
+    $result = Convert-TextRule -Text $result -Context $Context `
+        -Regex ([regex]'(?i)(?<![\p{L}\p{N}-])(?<label>[a-z0-9][a-z0-9-]*?)(?<suffix>-my|-admin)?\.sharepoint\.com\b') `
+        -Test { param($m) -not ($script:PlaceholderTenantLabels -contains $m.Groups['label'].Value.ToLowerInvariant()) } `
+        -Replacement $sharePointReplacement
+    $result = Convert-TextRule -Text $result -Context $Context `
+        -Regex ([regex]'(?i)(?<=/personal/)[^/\s"<>]+') `
+        -Test { param($m) -not (Test-IsPlaceholderText $m.Value) } `
+        -Replacement '<UPN-PATH>'
+
+    # 5. Directory object ids inside Graph URLs (@odata.bind, @odata.id, navigation links).
+    $objectIdReplacement = {
+        param($m)
+        $kind = $m.Groups['kind'].Value.ToLowerInvariant()
+        if ($kind -eq 'groups') {
+            if ($Context.Groups.ContainsKey($m.Value)) { return ('<GROUP:' + $Context.Groups[$m.Value] + '>') }
+            return '<GROUP-OBJECT-ID>'
+        }
+        if ($kind -eq 'users') { return '<USER-OBJECT-ID>' }
+        if ($kind -eq 'devices') { return '<DEVICE-ID>' }
+        if ($kind -eq 'serviceprincipals') { return '<APP-ID>' }
+        return '<OBJECT-ID>'
+    }
+    $result = Convert-TextRule -Text $result -Context $Context `
+        -Regex ([regex]('(?i)(?<=/(?<kind>groups|users|directoryObjects|devices|servicePrincipals)/)' + $script:GuidAnywherePattern)) `
+        -Test { param($m) $m.Value -ne $script:EmptyGuid } `
+        -Replacement $objectIdReplacement
+
+    # 6. MAC addresses.
+    $result = Convert-TextRule -Text $result -Context $Context `
+        -Regex ([regex]'\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\b') `
+        -Replacement '<MAC-ADDRESS>'
+
+    # 7. UNC hosts.
+    $result = Convert-TextRule -Text $result -Context $Context `
+        -Regex ([regex]'(?<=\\\\)[^\\\s"<>]+') `
+        -Test { param($m) -not (Test-IsPlaceholderText $m.Value) } `
+        -Replacement '<SERVER>'
+
+    # 8. Internal hostnames.
+    $result = Convert-TextRule -Text $result -Context $Context `
+        -Regex ([regex]'(?i)(?<![\p{L}\p{N}.-])[a-z0-9][a-z0-9-]*(?:\.[a-z0-9-]+)*\.(?:local|corp|internal|lan|intra)\b') `
+        -Replacement '<HOSTNAME>'
+
+    # 9. RFC 1918 IPv4 addresses.
+    $result = Convert-TextRule -Text $result -Context $Context `
+        -Regex ([regex]'\b(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3})\b') `
+        -Replacement '<IP-ADDRESS>'
+
+    return $result
+}
+
+function Test-IsBase64Blob {
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([AllowEmptyString()][string]$Value, [int]$MinLength)
+
+    if ($Value.Length -lt $MinLength) { return $false }
+    return ($Value -match '^[A-Za-z0-9+/\r\n]+={0,2}$')
+}
+
 function ConvertTo-SanitizedString {
     [CmdletBinding()]
     [OutputType([string])]
     param(
         [AllowEmptyString()][string]$Value,
         [AllowEmptyString()][string]$Key,
-        [hashtable]$Context
+        [hashtable]$Context,
+        [switch]$Secret
     )
 
     if ([string]::IsNullOrEmpty($Value)) { return $Value }
+    if (Test-IsPlaceholderText $Value) { return $Value }
+
+    if ($Key -and $Context.Keep.Contains($Key)) {
+        return (ConvertTo-SanitizedText -Value $Value -Context $Context)
+    }
+
+    # Secret values: by container (passed in by the caller) or by key name.
+    if ($Secret -or ($Key -and ($script:SecretKeys -contains $Key -or $Key -match $script:SecretKeySuffixPattern))) {
+        Add-Replacement -Context $Context -Placeholder '<SECRET>'
+        return '<SECRET>'
+    }
 
-    # 1. Key-driven placeholders.
     if ($Key) {
-        if ($script:GroupIdKeys -contains $Key -and (Test-IsGuidValue $Value) -and $Value -ne $script:EmptyGuid) {
+        $bareGuid = $Value.Trim().Trim('{', '}')
+        $isGuid = (Test-IsGuidValue $Value) -and $bareGuid -ne $script:EmptyGuid
+
+        if ($isGuid -and $script:GroupIdKeys -contains $Key) {
             $placeholder = '<GROUP-OBJECT-ID>'
-            if ($Context.Groups.ContainsKey($Value)) { $placeholder = '<GROUP:' + $Context.Groups[$Value] + '>' }
+            if ($Context.Groups.ContainsKey($bareGuid)) { $placeholder = '<GROUP:' + $Context.Groups[$bareGuid] + '>' }
             Add-Replacement -Context $Context -Placeholder $placeholder
             return $placeholder
         }
-        if ($script:FilterIdKeys -contains $Key -and (Test-IsGuidValue $Value) -and $Value -ne $script:EmptyGuid) {
+        if ($isGuid -and $script:FilterIdKeys -contains $Key) {
             $placeholder = '<FILTER-ID>'
-            if ($Context.Filters.ContainsKey($Value)) { $placeholder = '<FILTER:' + $Context.Filters[$Value] + '>' }
+            if ($Context.Filters.ContainsKey($bareGuid)) { $placeholder = '<FILTER:' + $Context.Filters[$bareGuid] + '>' }
             Add-Replacement -Context $Context -Placeholder $placeholder
             return $placeholder
         }
-        if ($script:GuidPlaceholderByKey.ContainsKey($Key) -and (Test-IsGuidValue $Value) -and $Value -ne $script:EmptyGuid) {
+        if ($isGuid -and $script:GuidPlaceholderByKey.ContainsKey($Key)) {
             $placeholder = $script:GuidPlaceholderByKey[$Key]
             Add-Replacement -Context $Context -Placeholder $placeholder
             return $placeholder
         }
-        if ($script:ValuePlaceholderByKey.ContainsKey($Key) -and -not (Test-IsPlaceholderText $Value)) {
+        if ($script:ValuePlaceholderByKey.ContainsKey($Key)) {
             $placeholder = $script:ValuePlaceholderByKey[$Key]
             Add-Replacement -Context $Context -Placeholder $placeholder
             return $placeholder
         }
-    }
-
-    $result = $Value
-
-    # 2. The source tenant's GUID anywhere inside the string.
-    if ($Context.TenantId -and $result.IndexOf($Context.TenantId, [System.StringComparison]::OrdinalIgnoreCase) -ge 0) {
-        $result = [regex]::Replace($result, [regex]::Escape($Context.TenantId), '<TENANT-ID>', 'IgnoreCase')
-        Add-Replacement -Context $Context -Placeholder '<TENANT-ID>'
-    }
-
-    # 3. E-mail addresses / UPNs that are not documentation placeholders. Done before the domain
-    #    rule so that user@tenant.onmicrosoft.com is replaced as a whole.
-    $emailRegex = [regex]'\b(?<local>[A-Za-z0-9._%+-]+)@(?<domain>[A-Za-z0-9.-]+\.[A-Za-z]{2,})\b'
-    $emailMatches = $emailRegex.Matches($result)
-    if ($emailMatches.Count -gt 0) {
-        $builder = New-Object System.Text.StringBuilder
-        $last = 0
-        foreach ($m in $emailMatches) {
-            [void]$builder.Append($result.Substring($last, $m.Index - $last))
-            if (Test-IsPlaceholderEmail -LocalPart $m.Groups['local'].Value -Domain $m.Groups['domain'].Value) {
-                [void]$builder.Append($m.Value)
-            } else {
-                [void]$builder.Append('<UPN>')
-                Add-Replacement -Context $Context -Placeholder '<UPN>'
-            }
-            $last = $m.Index + $m.Length
+        if ($script:BlobKeys -contains $Key -and (Test-IsBase64Blob -Value $Value -MinLength 16)) {
+            $placeholder = '<BASE64-BLOB-REMOVED:' + $Value.Length + '-CHARS>'
+            Add-Replacement -Context $Context -Placeholder '<BASE64-BLOB-REMOVED>'
+            return $placeholder
+        }
+        # Any other key that ends in Id/Ids or names a group, user, device, app or filter and holds a
+        # GUID is a tenant object reference unless listed as global.
+        if ($isGuid -and $Key -match '(?i)(ids?$|group|user|device|app|filter|owner|principal|member)' -and -not ($script:KeptIdKeys -contains $Key)) {
+            $placeholder = Get-TypedGuidPlaceholder -Key $Key
+            if ($placeholder -eq '<GROUP-OBJECT-ID>' -and $Context.Groups.ContainsKey($bareGuid)) { $placeholder = '<GROUP:' + $Context.Groups[$bareGuid] + '>' }
+            Add-Replacement -Context $Context -Placeholder $placeholder
+            return $placeholder
         }
-        [void]$builder.Append($result.Substring($last))
-        $result = $builder.ToString()
     }
 
-    # 4. Tenant domains that are not placeholders.
-    $domainRegex = [regex]'(?i)\b(?<label>[a-z0-9-]+)\.onmicrosoft\.com\b'
-    $domainMatches = $domainRegex.Matches($result)
-    if ($domainMatches.Count -gt 0) {
-        $builder = New-Object System.Text.StringBuilder
-        $last = 0
-        foreach ($m in $domainMatches) {
-            [void]$builder.Append($result.Substring($last, $m.Index - $last))
-            if ($script:PlaceholderTenantLabels -contains $m.Groups['label'].Value.ToLowerInvariant()) {
-                [void]$builder.Append($m.Value)
-            } else {
-                [void]$builder.Append('<TENANT>.onmicrosoft.com')
-                Add-Replacement -Context $Context -Placeholder '<TENANT>.onmicrosoft.com'
-            }
-            $last = $m.Index + $m.Length
-        }
-        [void]$builder.Append($result.Substring($last))
-        $result = $builder.ToString()
+    if (Test-IsBase64Blob -Value $Value -MinLength $script:BlobMinLength) {
+        $placeholder = '<BASE64-BLOB-REMOVED:' + $Value.Length + '-CHARS>'
+        Add-Replacement -Context $Context -Placeholder '<BASE64-BLOB-REMOVED>'
+        return $placeholder
     }
 
-    return $result
+    return (ConvertTo-SanitizedText -Value $Value -Context $Context)
 }
 
 function Get-ObjectPair {
@@ -402,16 +640,17 @@ function ConvertTo-SanitizedValue {
     param(
         [AllowNull()][object]$Value,
         [AllowEmptyString()][string]$Key,
-        [hashtable]$Context
+        [hashtable]$Context,
+        [switch]$Secret
     )
 
     if ($null -eq $Value) { return $null }
-    if ($Value -is [string]) { return (ConvertTo-SanitizedString -Value $Value -Key $Key -Context $Context) }
-    if (Test-IsObjectLike $Value) { return (ConvertTo-SanitizedObject -Object $Value -Context $Context) }
+    if ($Value -is [string]) { return (ConvertTo-SanitizedString -Value $Value -Key $Key -Context $Context -Secret:$Secret) }
+    if (Test-IsObjectLike $Value) { return (ConvertTo-SanitizedObject -Object $Value -Context $Context -ParentKey $Key) }
     if (Test-IsArrayLike $Value) {
         $items = New-Object System.Collections.Generic.List[object]
         foreach ($item in $Value) {
-            $items.Add((ConvertTo-SanitizedValue -Value $item -Key $Key -Context $Context))
+            $items.Add((ConvertTo-SanitizedValue -Value $item -Key $Key -Context $Context -Secret:$Secret))
         }
         return , $items.ToArray()
     }
@@ -423,7 +662,8 @@ function ConvertTo-SanitizedObject {
     [OutputType([System.Collections.Specialized.OrderedDictionary])]
     param(
         [object]$Object,
-        [hashtable]$Context
+        [hashtable]$Context,
+        [AllowEmptyString()][string]$ParentKey = ''
     )
 
     $pairs = Get-ObjectPair -Object $Object
@@ -432,6 +672,14 @@ function ConvertTo-SanitizedObject {
     $keys = New-Object 'System.Collections.Generic.List[string]'
     foreach ($k in $byKey.Keys) { $keys.Add($k) }
     $keys.Sort([System.StringComparer]::Ordinal)
+
+    # Object-level facts that change how members are treated.
+    $odataType = ''
+    if ($byKey.ContainsKey('@odata.type') -and $byKey['@odata.type'] -is [string]) { $odataType = $byKey['@odata.type'] }
+    $isSecretContainer = ($odataType -match '(?i)SecretSettingValue$')
+    if ($byKey.ContainsKey('isEncrypted') -and $byKey['isEncrypted'] -is [bool] -and $byKey['isEncrypted']) { $isSecretContainer = $true }
+    $keepsGlobalId = ($script:GlobalIdParentKeys -contains $ParentKey) -or ($odataType -match $script:GlobalIdTypePattern)
+
     $result = New-Object System.Collections.Specialized.OrderedDictionary ([System.StringComparer]::Ordinal)
 
     foreach ($key in $keys) {
@@ -444,7 +692,8 @@ function ConvertTo-SanitizedObject {
             foreach ($suffix in $script:RemovedPropertySuffixes) {
                 if ($key.EndsWith($suffix, [System.StringComparison]::OrdinalIgnoreCase)) { $drop = $true }
             }
-            if ($key -eq 'id' -and (Test-IsGuidValue $value)) { $drop = $true }
+            if ($key -eq 'id' -and -not $keepsGlobalId -and $value -is [string] -and $value -match $script:GuidAnywherePattern) { $drop = $true }
+            if ($key -eq 'id' -and -not $keepsGlobalId -and $value -is [guid]) { $drop = $true }
             if ($Context.RemoveAssignments -and $key -eq 'assignments') { $drop = $true }
             if ($drop) {
                 $Context.Stats.PropertiesRemoved++
@@ -452,7 +701,12 @@ function ConvertTo-SanitizedObject {
             }
         }
 
-        $result[$key] = ConvertTo-SanitizedValue -Value $value -Key $key -Context $Context
+        $secretMember = $isSecretContainer -and ($key -eq 'value')
+        $outKey = ConvertTo-SanitizedText -Value $key -Context $Context
+        # A kept global id must not fall into the key-driven GUID rules either.
+        $ruleKey = $key
+        if ($keepsGlobalId -and $key -eq 'id') { $ruleKey = '' }
+        $result[$outKey] = ConvertTo-SanitizedValue -Value $value -Key $ruleKey -Context $Context -Secret:$secretMember
     }
 
     return $result
@@ -467,22 +721,17 @@ function Format-JsonString {
     [void]$sb.Append('"')
     foreach ($ch in $Value.ToCharArray()) {
         $code = [int]$ch
-        switch ($ch) {
-            '"' { [void]$sb.Append('\"'); continue }
-            '\' { [void]$sb.Append('\\'); continue }
-            "`n" { [void]$sb.Append('\n'); continue }
-            "`r" { [void]$sb.Append('\r'); continue }
-            "`t" { [void]$sb.Append('\t'); continue }
-            "`b" { [void]$sb.Append('\b'); continue }
-            "`f" { [void]$sb.Append('\f'); continue }
-            default {
-                if ($code -lt 0x20) {
-                    [void]$sb.Append('\u' + $code.ToString('x4'))
-                } else {
-                    [void]$sb.Append($ch)
-                }
-            }
-        }
+        # Branch on the code point. A switch on the char itself compares culture-sensitively and
+        # treats soft hyphens, zero-width characters and control characters as equal to "`b".
+        if ($code -eq 0x22) { [void]$sb.Append('\"') }
+        elseif ($code -eq 0x5C) { [void]$sb.Append('\\') }
+        elseif ($code -eq 0x0A) { [void]$sb.Append('\n') }
+        elseif ($code -eq 0x0D) { [void]$sb.Append('\r') }
+        elseif ($code -eq 0x09) { [void]$sb.Append('\t') }
+        elseif ($code -eq 0x08) { [void]$sb.Append('\b') }
+        elseif ($code -eq 0x0C) { [void]$sb.Append('\f') }
+        elseif ($code -lt 0x20 -or $code -eq 0x7F) { [void]$sb.Append('\u' + $code.ToString('x4')) }
+        else { [void]$sb.Append($ch) }
     }
     [void]$sb.Append('"')
     return $sb.ToString()
@@ -493,10 +742,12 @@ function Format-JsonDate {
     [OutputType([string])]
     param([datetime]$Value)
 
+    $inv = [System.Globalization.CultureInfo]::InvariantCulture
+    if ($Value.Kind -eq [System.DateTimeKind]::Local) { $Value = $Value.ToUniversalTime() }
     if ($Value.Kind -eq [System.DateTimeKind]::Utc) {
-        return $Value.ToString('yyyy-MM-ddTHH:mm:ss.FFFFFFFZ', [System.Globalization.CultureInfo]::InvariantCulture)
+        return $Value.ToString('yyyy-MM-ddTHH:mm:ss.FFFFFFFZ', $inv)
     }
-    return $Value.ToString('yyyy-MM-ddTHH:mm:ss.FFFFFFFK', [System.Globalization.CultureInfo]::InvariantCulture)
+    return $Value.ToString('yyyy-MM-ddTHH:mm:ss.FFFFFFF', $inv)
 }
 
 function ConvertTo-StableJson {
@@ -517,11 +768,14 @@ function ConvertTo-StableJson {
     if ($Value -is [string]) { return (Format-JsonString -Value $Value) }
     if ($Value -is [bool]) { if ($Value) { return 'true' } else { return 'false' } }
     if ($Value -is [datetime]) { return ('"' + (Format-JsonDate -Value $Value) + '"') }
-    if ($Value -is [System.DateTimeOffset]) { return ('"' + $Value.ToString('yyyy-MM-ddTHH:mm:ss.FFFFFFFK', $inv) + '"') }
+    if ($Value -is [System.DateTimeOffset]) { return ('"' + $Value.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss.FFFFFFFZ', $inv) + '"') }
     if ($Value -is [guid]) { return ('"' + $Value.ToString() + '"') }
     if ($Value -is [char]) { return (Format-JsonString -Value ([string]$Value)) }
-    if ($Value -is [double] -or $Value -is [single]) { return $Value.ToString('R', $inv) }
-    if ($Value -is [decimal]) { return $Value.ToString($inv) }
+    if ($Value -is [double] -or $Value -is [single] -or $Value -is [decimal]) {
+        $d = [double]$Value
+        if ($d -eq 0) { return '0' }
+        return $d.ToString('R', $inv)
+    }
     if ($Value -is [System.ValueType]) { return $Value.ToString($inv) }
 
     if (Test-IsObjectLike $Value) {
@@ -547,21 +801,29 @@ function ConvertTo-StableJson {
     return (Format-JsonString -Value ([string]$Value))
 }
 
-function Read-JsonFile {
+function ConvertFrom-JsonText {
+    # ConvertFrom-Json with the same result on every PowerShell version: strings stay strings
+    # (PowerShell 7 would turn ISO 8601 dates into DateTime), and a top-level array stays an array.
     [CmdletBinding()]
-    param([string]$FilePath)
-
-    $raw = [System.IO.File]::ReadAllText($FilePath, [System.Text.Encoding]::UTF8)
-    if ([string]::IsNullOrWhiteSpace($raw)) { throw "File is empty: $FilePath" }
+    param([AllowEmptyString()][string]$Text)
 
-    # PowerShell 7 turns ISO 8601 strings into DateTime objects and unrolls top-level arrays unless told
-    # otherwise; Windows PowerShell 5.1 has neither parameter. Use what is available.
     $params = (Get-Command ConvertFrom-Json).Parameters
     $splat = @{}
     if ($params.ContainsKey('DateKind')) { $splat['DateKind'] = 'String' }
     if ($params.ContainsKey('NoEnumerate')) { $splat['NoEnumerate'] = $true }
     if ($params.ContainsKey('Depth')) { $splat['Depth'] = 100 }
-    return ($raw | ConvertFrom-Json @splat)
+    $parsed = $Text | ConvertFrom-Json @splat
+    if ($null -eq $parsed -and $Text.TrimStart().StartsWith('[')) { return , @() }
+    return , $parsed
+}
+
+function Read-JsonFile {
+    [CmdletBinding()]
+    param([string]$FilePath)
+
+    $raw = [System.IO.File]::ReadAllText($FilePath, [System.Text.Encoding]::UTF8)
+    if ([string]::IsNullOrWhiteSpace($raw)) { throw "File is empty: $FilePath" }
+    return , (ConvertFrom-JsonText -Text $raw)
 }
 
 function Read-NameMap {
@@ -572,15 +834,25 @@ function Read-NameMap {
     $map = @{ Groups = @{}; Filters = @{} }
     if (-not $FilePath) { return $map }
     if (-not (Test-Path -LiteralPath $FilePath -PathType Leaf)) { throw "Name map file not found: $FilePath" }
+    $resolved = (Resolve-Path -LiteralPath $FilePath).ProviderPath
 
-    $obj = Read-JsonFile -FilePath $FilePath
+    $obj = Read-JsonFile -FilePath $resolved
+    if (-not (Test-IsObjectLike $obj)) { throw "Name map must be a JSON object with 'groups' and/or 'filters': $FilePath" }
     foreach ($section in @('groups', 'filters')) {
-        $prop = $obj.PSObject.Properties[$section]
-        if ($null -eq $prop -or $null -eq $prop.Value) { continue }
+        $sectionValue = $null
+        foreach ($pair in (Get-ObjectPair -Object $obj)) { if ($pair.Key -eq $section) { $sectionValue = $pair.Value } }
+        if ($null -eq $sectionValue) { continue }
+        if (-not (Test-IsObjectLike $sectionValue)) { throw "Name map section '$section' must be an object of id -> display name." }
         $target = $map.Groups
         if ($section -eq 'filters') { $target = $map.Filters }
-        foreach ($pair in (Get-ObjectPair -Object $prop.Value)) {
-            $target[[string]$pair.Key] = [string]$pair.Value
+        foreach ($pair in (Get-ObjectPair -Object $sectionValue)) {
+            $id = ([string]$pair.Key).Trim()
+            $name = [string]$pair.Value
+            if (-not (Test-IsGuidValue $id)) { throw "Name map '$section' key is not a GUID: '$id'" }
+            if ([string]::IsNullOrWhiteSpace($name)) { throw "Name map '$section' entry '$id' has an empty name." }
+            if ($name -match '[<>"\r\n\t@]') { throw "Name map '$section' entry '$id' contains a character that is not allowed in a placeholder (< > quote line break @): '$name'" }
+            if ($name -match ('(?i)\.onmicrosoft\.com|' + $script:GuidAnywherePattern)) { throw "Name map '$section' entry '$id' looks tenant-specific: '$name'" }
+            $target[$id.Trim('{', '}')] = $name.Trim()
         }
     }
     return $map
@@ -627,6 +899,26 @@ function Get-OutputFilePath {
     return (Join-Path $File.DirectoryName ($base + '.sanitized.json'))
 }
 
+function Get-ReviewHint {
+    # Lines of the sanitized output that still contain a GUID or an IPv4 address.
+    [CmdletBinding()]
+    [OutputType([string[]])]
+    param([string]$Json)
+
+    $hints = New-Object System.Collections.Generic.List[string]
+    $lines = $Json -split "`n"
+    for ($i = 0; $i -lt $lines.Count -and $hints.Count -lt 25; $i++) {
+        $line = $lines[$i]
+        $why = @()
+        if ($line -match $script:GuidAnywherePattern) { $why += 'GUID' }
+        if ($line -match '\b(?:\d{1,3}\.){3}\d{1,3}\b') { $why += 'IPv4' }
+        if ($why.Count -gt 0) {
+            $hints.Add(('line {0} ({1}): {2}' -f ($i + 1), ($why -join ', '), $line.Trim()))
+        }
+    }
+    return $hints.ToArray()
+}
+
 #endregion Helpers
 
 #region Main
@@ -637,6 +929,9 @@ if ($MyInvocation.InvocationName -ne '.') {
     if ($InPlace -and $OutputPath) { throw '-InPlace and -OutputPath cannot be combined.' }
     if ($TenantId -and -not (Test-IsGuidValue $TenantId)) { throw "-TenantId must be a GUID, got '$TenantId'." }
 
+    # .NET file APIs resolve relative paths against the process directory, not PowerShell's location.
+    if ($OutputPath) { $OutputPath = $ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath($OutputPath) }
+
     $nameMap = Read-NameMap -FilePath $NameMapPath
     $inputs = Get-InputFileList -Path $Path -InPlace:$InPlace
     if ($inputs.Count -eq 0) { Write-Warning 'No JSON files found.'; return }
@@ -649,6 +944,7 @@ if ($MyInvocation.InvocationName -ne '.') {
             -RemoveProperty $RemoveProperty -KeepProperty $KeepProperty -RemoveAssignments:$RemoveAssignments
 
         $data = Read-JsonFile -FilePath $file.FullName
+        Add-TenantIdFromObject -Value $data -Context $context
         $sanitized = ConvertTo-SanitizedValue -Value $data -Key '' -Context $context
         $json = (ConvertTo-StableJson -Value $sanitized) + "`n"
 
@@ -671,6 +967,7 @@ if ($MyInvocation.InvocationName -ne '.') {
                 PropertiesRemoved = $context.Stats.PropertiesRemoved
                 ValuesReplaced    = $context.Stats.ValuesReplaced
                 Placeholders      = @($context.Placeholders | Sort-Object)
+                ReviewHints       = @(Get-ReviewHint -Json $json)
             }
         }
     }
diff --git a/tests/ConvertTo-SanitizedIntuneExport.Tests.ps1 b/tests/ConvertTo-SanitizedIntuneExport.Tests.ps1
index cc43d3f..3ba456b 100644
--- a/tests/ConvertTo-SanitizedIntuneExport.Tests.ps1
+++ b/tests/ConvertTo-SanitizedIntuneExport.Tests.ps1
@@ -3,11 +3,13 @@
 # The script's functions are loaded by dot-sourcing (its main block only runs when invoked
 # directly). File-mode tests call the script with & so the main block runs.
 # Identifiers in fixtures are built at run time so this file never contains anything that
-# looks like a real tenant, group, or user.
+# looks like a real tenant, group, or user. Join-Path is used with two arguments only so the
+# file also runs on Windows PowerShell 5.1.
 
 BeforeAll {
-    $script:scriptPath = Join-Path $PSScriptRoot '..' 'scripts' 'powershell' 'ConvertTo-SanitizedIntuneExport.ps1'
-    $script:guardPath = Join-Path $PSScriptRoot '..' '.github' 'scripts' 'Test-RepoSanitized.ps1'
+    $repoRoot = Join-Path $PSScriptRoot '..'
+    $script:scriptPath = Join-Path (Join-Path (Join-Path $repoRoot 'scripts') 'powershell') 'ConvertTo-SanitizedIntuneExport.ps1'
+    $script:guardPath = Join-Path (Join-Path (Join-Path $repoRoot '.github') 'scripts') 'Test-RepoSanitized.ps1'
     . $script:scriptPath
 
     $script:tenant = '1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d'
@@ -16,11 +18,14 @@ BeforeAll {
     $script:filter1 = '4d5e6f7a-8b9c-4d0e-1f2a-3b4c5d6e7f8a'
     $script:objectId = '5e6f7a8b-9c0d-4e1f-2a3b-4c5d6e7f8a9b'
     $script:templateId = '6f7a8b9c-0d1e-4f2a-3b4c-5d6e7f8a9b0c'
+    $script:definitionId = '7a8b9c0d-1e2f-4a3b-4c5d-6e7f8a9b0c1d'
+    $script:realDomain = 'northwindtraders99'
 
     function Get-RawExportJson {
         # A composite fixture that looks like a Graph export of a Settings Catalog policy with
-        # assignments, plus compliance-style scheduled actions and some device/user fields.
-        $domain = 'northwindtraders99.onmicrosoft.com'
+        # assignments, plus compliance-style scheduled actions, ADMX bindings, secrets and some
+        # device/user fields.
+        $domain = $script:realDomain + '.onmicrosoft.com'
         return @"
 {
   "@odata.context": "https://graph.microsoft.com/beta/`$metadata#deviceManagement/configurationPolicies/`$entity",
@@ -36,6 +41,7 @@ BeforeAll {
   "priorityMetaData": null,
   "roleScopeTagIds": [ "0" ],
   "templateReference": { "templateId": "$($script:templateId)_1", "templateFamily": "endpointSecurityDiskEncryption", "templateDisplayName": "BitLocker", "templateDisplayVersion": "Version 1" },
+  "settings@odata.context": "https://graph.microsoft.com/beta/`$metadata#deviceManagement/configurationPolicies('$($script:objectId)')/settings",
   "settings": [
     {
       "id": "0",
@@ -53,11 +59,20 @@ BeforeAll {
         "settingDefinitionId": "device_vendor_msft_bitlocker_encryptionmethodbydrivetype",
         "simpleSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationIntegerSettingValue", "value": 7 }
       }
+    },
+    {
+      "id": "2",
+      "settingInstance": {
+        "@odata.type": "#microsoft.graph.deviceManagementConfigurationSimpleSettingInstance",
+        "settingDefinitionId": "device_vendor_msft_accounts_localadmin_password",
+        "simpleSettingValue": { "@odata.type": "#microsoft.graph.deviceManagementConfigurationSecretSettingValue", "valueState": "notEncrypted", "value": "Sup3rS3cretLocalAdmin!2026" }
+      }
     }
   ],
   "assignments": [
     {
       "id": "$($script:objectId)_$($script:group1)",
+      "sourceId": "$($script:objectId)",
       "target": {
         "@odata.type": "#microsoft.graph.groupAssignmentTarget",
         "groupId": "$($script:group1)",
@@ -75,17 +90,40 @@ BeforeAll {
       "id": "$($script:objectId)",
       "ruleName": "PasswordRequired",
       "scheduledActionConfigurations": [
-        { "id": "$($script:group1)", "actionType": "block", "gracePeriodHours": 0, "notificationTemplateId": "00000000-0000-0000-0000-000000000000", "notificationMessageCCList": [] }
+        { "id": "$($script:group1)", "actionType": "notification", "gracePeriodHours": 0, "notificationTemplateId": "$($script:templateId)", "notificationMessageCCList": [ "$($script:group2)" ] },
+        { "id": "$($script:group2)", "actionType": "block", "gracePeriodHours": 0, "notificationTemplateId": "00000000-0000-0000-0000-000000000000", "notificationMessageCCList": [] }
       ]
     }
   ],
+  "definitionValues": [
+    {
+      "id": "$($script:objectId)",
+      "enabled": true,
+      "definition@odata.bind": "https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions('$($script:definitionId)')",
+      "definition": { "id": "$($script:definitionId)", "@odata.type": "#microsoft.graph.groupPolicyDefinition", "displayName": "Turn off Autoplay" }
+    }
+  ],
+  "omaSettings": [
+    { "@odata.type": "#microsoft.graph.omaSettingString", "omaUri": "./Device/Vendor/MSFT/Accounts/Users/localadmin/Password", "displayName": "Local admin password", "value": "PlainTextP@ss2026", "isEncrypted": true, "secretReferenceValueId": "$($script:objectId)_$($script:group1)" }
+  ],
   "ownerDevice": {
     "deviceId": "$($script:group2)",
+    "azureActiveDirectoryDeviceId": "$($script:group1)",
     "serialNumber": "5CG1234ABC",
     "userPrincipalName": "kim.lee@$domain",
     "enrolledByUserId": "$($script:group1)",
     "wifiMacAddress": "00-11-22-33-44-55",
-    "deviceName": "LAPTOP-SAMPLE-01"
+    "deviceName": "NW-LT-KLEE-01",
+    "ownerId": "$($script:group1)",
+    "targetedMobileApps": [ "$($script:group2)" ],
+    "group@odata.bind": "https://graph.microsoft.com/v1.0/groups/$($script:group1)",
+    "preSharedKey": "CorpWifi2026!Secret",
+    "intranet": "https://intranet.$($script:realDomain).local/ and \\\\nwfs01.corp.$($script:realDomain).local\\software and proxy 10.20.30.40:8080",
+    "sharepoint": "https://$($script:realDomain)-my.sharepoint.com/personal/kim_lee_$($script:realDomain)_com/Documents",
+    "routing": "$($script:realDomain).mail.onmicrosoft.com",
+    "guest": "kim.lee_$($script:realDomain).com#EXT#@$domain",
+    "encoded": "https://graph.microsoft.com/v1.0/users/kim.lee%40$($script:realDomain).com/managedDevices",
+    "payload": "UEsDBBQAAAAIAHSmaFkAAAAAAAAAAAAAAAAIAAAAbW9iaWxlY29uZmlnUEsFBgAAAAABAAEANgAAAAAAAAAAAA=="
   },
   "version": 3,
   "supportsScopeTags": true,
@@ -103,8 +141,9 @@ BeforeAll {
 
     function Invoke-Sanitize {
         param([string]$Json, [hashtable]$ContextArgs = @{})
-        $obj = $Json | ConvertFrom-Json -DateKind String -NoEnumerate
+        $obj = ConvertFrom-JsonText -Text $Json
         $ctx = Initialize-SanitizeContext @ContextArgs
+        Add-TenantIdFromObject -Value $obj -Context $ctx
         $out = ConvertTo-SanitizedValue -Value $obj -Key '' -Context $ctx
         return @{ Object = $out; Context = $ctx; Json = (ConvertTo-StableJson -Value $out) }
     }
@@ -116,7 +155,7 @@ Describe 'ConvertTo-SanitizedIntuneExport' {
         BeforeAll { $script:r = Invoke-Sanitize -Json (Get-RawExportJson) -ContextArgs @{ TenantId = $script:tenant } }
 
         It 'removes export metadata at the top level' {
-            foreach ($k in @('@odata.context', 'createdDateTime', 'lastModifiedDateTime', 'settingCount', 'isAssigned', 'priorityMetaData', 'version', 'supportsScopeTags', 'assignments@odata.count')) {
+            foreach ($k in @('@odata.context', 'createdDateTime', 'lastModifiedDateTime', 'settingCount', 'isAssigned', 'priorityMetaData', 'version', 'supportsScopeTags', 'assignments@odata.count', 'settings@odata.context')) {
                 $script:r.Object.Contains($k) | Should -BeFalse -Because "$k is tenant-specific metadata"
             }
         }
@@ -129,11 +168,16 @@ Describe 'ConvertTo-SanitizedIntuneExport' {
             $script:r.Object['scheduledActionsForRule'][0]['scheduledActionConfigurations'][0].Contains('id') | Should -BeFalse
         }
 
-        It 'removes assignment ids composed of GUIDs only when they are exact GUIDs' {
-            # "<policyId>_<groupId>" is not a bare GUID, so it is kept and the tenant GUIDs inside
-            # it are not touched by the id rule. The guard would still accept it because the key is id
-            # with a non-GUID value; the test documents the behavior.
-            $script:r.Object['assignments'][0].Contains('id') | Should -BeTrue
+        It 'removes composite assignment ids and sourceId' {
+            $script:r.Object['assignments'][0].Contains('id') | Should -BeFalse
+            $script:r.Object['assignments'][0].Contains('sourceId') | Should -BeFalse
+        }
+
+        It 'keeps the id of ADMX definitions and the definition@odata.bind reference' {
+            $dv = $script:r.Object['definitionValues'][0]
+            $dv.Contains('id') | Should -BeFalse
+            $dv['definition']['id'] | Should -Be $script:definitionId
+            $dv['definition@odata.bind'] | Should -Be ("https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions('" + $script:definitionId + "')")
         }
 
         It 'keeps settings, template references and scope tags' {
@@ -152,10 +196,11 @@ Describe 'ConvertTo-SanitizedIntuneExport' {
     Context 'Replacement rules' {
         BeforeAll {
             $script:r = Invoke-Sanitize -Json (Get-RawExportJson) -ContextArgs @{
-                TenantId   = $script:tenant
-                GroupNames = @{ $script:group1 = 'WIN-Ring-R1' }
+                TenantId    = $script:tenant
+                GroupNames  = @{ $script:group1 = 'WIN-Ring-R1' }
                 FilterNames = @{ $script:filter1 = 'Corporate Windows' }
             }
+            $script:d = $script:r.Object['ownerDevice']
         }
 
         It 'maps known group and filter ids to names and unknown ones to generic placeholders' {
@@ -169,38 +214,99 @@ Describe 'ConvertTo-SanitizedIntuneExport' {
         }
 
         It 'replaces device and user identifiers by key' {
-            $d = $script:r.Object['ownerDevice']
-            $d['deviceId'] | Should -Be '<DEVICE-ID>'
-            $d['enrolledByUserId'] | Should -Be '<USER-OBJECT-ID>'
-            $d['serialNumber'] | Should -Be '<SERIAL>'
-            $d['userPrincipalName'] | Should -Be '<UPN>'
-            $d['wifiMacAddress'] | Should -Be '<MAC-ADDRESS>'
-            $d['deviceName'] | Should -Be 'LAPTOP-SAMPLE-01'
+            $script:d['deviceId'] | Should -Be '<DEVICE-ID>'
+            $script:d['azureActiveDirectoryDeviceId'] | Should -Be '<DEVICE-ID>'
+            $script:d['enrolledByUserId'] | Should -Be '<USER-OBJECT-ID>'
+            $script:d['ownerId'] | Should -Be '<USER-OBJECT-ID>'
+            $script:d['serialNumber'] | Should -Be '<SERIAL>'
+            $script:d['userPrincipalName'] | Should -Be '<UPN>'
+            $script:d['wifiMacAddress'] | Should -Be '<MAC-ADDRESS>'
+            $script:d['deviceName'] | Should -Be '<DEVICE-NAME>'
+        }
+
+        It 'replaces GUIDs under unknown *Id keys with a typed placeholder' {
+            $script:d['targetedMobileApps'] | Should -Be @('<APP-ID>')
+        }
+
+        It 'replaces secrets: secret setting values, encrypted OMA-URI values, and secret-looking keys' {
+            $script:r.Object['settings'][2]['settingInstance']['simpleSettingValue']['value'] | Should -Be '<SECRET>'
+            $script:r.Object['settings'][2]['settingInstance']['simpleSettingValue']['valueState'] | Should -Be 'notEncrypted'
+            $script:r.Object['omaSettings'][0]['value'] | Should -Be '<SECRET>'
+            $script:r.Object['omaSettings'][0]['secretReferenceValueId'] | Should -Be '<SECRET-REFERENCE-ID>'
+            $script:d['preSharedKey'] | Should -Be '<SECRET>'
+        }
+
+        It 'replaces group ids in notification CC lists and notification template ids' {
+            $cfg = $script:r.Object['scheduledActionsForRule'][0]['scheduledActionConfigurations']
+            $cfg[0]['notificationMessageCCList'] | Should -Be @('<GROUP-OBJECT-ID>')
+            $cfg[0]['notificationTemplateId'] | Should -Be '<NOTIFICATION-TEMPLATE-ID>'
+            $cfg[1]['notificationTemplateId'] | Should -Be '00000000-0000-0000-0000-000000000000'
+        }
+
+        It 'replaces directory object ids inside @odata.bind URLs' {
+            $script:d['group@odata.bind'] | Should -Be 'https://graph.microsoft.com/v1.0/groups/<GROUP:WIN-Ring-R1>'
+        }
+
+        It 'replaces internal hostnames, UNC hosts and private IP addresses' {
+            $script:d['intranet'] | Should -Be 'https://<HOSTNAME>/ and \\<SERVER>\software and proxy <IP-ADDRESS>:8080'
         }
 
-        It 'leaves the empty GUID alone' {
-            $script:r.Object['scheduledActionsForRule'][0]['scheduledActionConfigurations'][0]['notificationTemplateId'] | Should -Be '00000000-0000-0000-0000-000000000000'
+        It 'replaces SharePoint hosts, personal-site paths and routing domains' {
+            $script:d['sharepoint'] | Should -Be 'https://<TENANT>-my.sharepoint.com/personal/<UPN-PATH>/Documents'
+            $script:d['routing'] | Should -Be '<TENANT>.onmicrosoft.com'
+        }
+
+        It 'replaces guest and URL-encoded UPNs as a whole' {
+            $script:d['guest'] | Should -Be '<UPN>'
+            $script:d['encoded'] | Should -Be 'https://graph.microsoft.com/v1.0/users/<UPN>/managedDevices'
+        }
+
+        It 'removes base64 payloads' {
+            $script:d['payload'] | Should -Match '^<BASE64-BLOB-REMOVED:\d+-CHARS>$'
         }
 
         It 'records the placeholders it used' {
             $script:r.Context.Placeholders | Should -Contain '<TENANT-ID>'
             $script:r.Context.Placeholders | Should -Contain '<GROUP:WIN-Ring-R1>'
             $script:r.Context.Placeholders | Should -Contain '<UPN>'
-            $script:r.Context.Stats.ValuesReplaced | Should -BeGreaterThan 5
+            $script:r.Context.Placeholders | Should -Contain '<SECRET>'
+            $script:r.Context.Stats.ValuesReplaced | Should -BeGreaterThan 15
+        }
+
+        It 'learns the tenant id from a tenantId key when -TenantId is not given, including the dash-less form' {
+            $json = '{ "tenantId": "' + $script:tenant.ToUpperInvariant() + '", "url": "https://login.microsoftonline.com/' + $script:tenant + '/oauth2", "tid": "tid=' + $script:tenant.Replace('-', '') + '" }'
+            $r2 = Invoke-Sanitize -Json $json
+            $r2.Object['tenantId'] | Should -Be '<TENANT-ID>'
+            $r2.Object['url'] | Should -Be 'https://login.microsoftonline.com/<TENANT-ID>/oauth2'
+            $r2.Object['tid'] | Should -Be 'tid=<TENANT-ID>'
         }
 
-        It 'replaces a bare tenant domain with a placeholder domain' {
-            $r2 = Invoke-Sanitize -Json '{ "x": "Sync to northwindtraders99.onmicrosoft.com and contoso.onmicrosoft.com" }'
-            $r2.Object['x'] | Should -Be 'Sync to <TENANT>.onmicrosoft.com and contoso.onmicrosoft.com'
+        It 'replaces a non-ASCII e-mail address and keeps placeholder domains' {
+            $json = '{ "a": "kim.m' + [char]0x00FC + 'ller@' + $script:realDomain + '.com and user@contoso.com" }'
+            $r2 = Invoke-Sanitize -Json $json
+            $r2.Object['a'] | Should -Be '<UPN> and user@contoso.com'
         }
 
-        It 'does not replace a tenant domain or e-mail that is already a placeholder' {
-            $r2 = Invoke-Sanitize -Json '{ "a": "<UPN>", "userPrincipalName": "<UPN>", "b": "user@contoso.com" }'
+        It 'does not replace values that are already placeholders' {
+            $r2 = Invoke-Sanitize -Json '{ "a": "<UPN>", "userPrincipalName": "<UPN>", "b": "user@contoso.com", "password": "<SECRET>" }'
             $r2.Object['a'] | Should -Be '<UPN>'
             $r2.Object['userPrincipalName'] | Should -Be '<UPN>'
             $r2.Object['b'] | Should -Be 'user@contoso.com'
+            $r2.Object['password'] | Should -Be '<SECRET>'
             $r2.Context.Stats.ValuesReplaced | Should -Be 0
         }
+
+        It 'sanitizes object keys that carry identifiers' {
+            $r2 = Invoke-Sanitize -Json ('{ "kim.lee@' + $script:realDomain + '.com": 1, "definition@odata.bind": "x" }')
+            $r2.Object.Contains('<UPN>') | Should -BeTrue
+            $r2.Object.Contains('definition@odata.bind') | Should -BeTrue
+        }
+
+        It 'keeps global catalog ids under *Id keys' {
+            $r2 = Invoke-Sanitize -Json ('{ "settingDefinitionId": "x", "settingInstanceTemplateId": "' + $script:templateId + '", "clientId": "' + $script:templateId + '" }')
+            $r2.Object['settingInstanceTemplateId'] | Should -Be $script:templateId
+            $r2.Object['clientId'] | Should -Be $script:templateId
+        }
     }
 
     Context 'Keep, remove and assignment options' {
@@ -242,9 +348,14 @@ Describe 'ConvertTo-SanitizedIntuneExport' {
             $r.Json | Should -Be $expected
         }
 
-        It 'serializes empty containers, numbers, booleans and null' {
-            $r = Invoke-Sanitize -Json '{ "o": {}, "a": [], "n": null, "f": false, "d": 1.5, "i": 42, "big": 12345678901234 }'
-            $r.Json | Should -Be ('{' + "`n" + '  "a": [],' + "`n" + '  "big": 12345678901234,' + "`n" + '  "d": 1.5,' + "`n" + '  "f": false,' + "`n" + '  "i": 42,' + "`n" + '  "n": null,' + "`n" + '  "o": {}' + "`n" + '}')
+        It 'serializes empty containers, numbers, booleans and null, normalizing fractional numbers' {
+            $r = Invoke-Sanitize -Json '{ "o": {}, "a": [], "n": null, "f": false, "d": 1.5, "i": 42, "big": 12345678901234, "one": 1.0, "negzero": -0.0 }'
+            $r.Json | Should -Be ('{' + "`n" + '  "a": [],' + "`n" + '  "big": 12345678901234,' + "`n" + '  "d": 1.5,' + "`n" + '  "f": false,' + "`n" + '  "i": 42,' + "`n" + '  "n": null,' + "`n" + '  "negzero": 0,' + "`n" + '  "o": {},' + "`n" + '  "one": 1' + "`n" + '}')
+        }
+
+        It 'normalizes decimal values the way PowerShell 7 parses them' {
+            ConvertTo-StableJson -Value ([decimal]'2.50') | Should -Be '2.5'
+            ConvertTo-StableJson -Value ([decimal]'1.0') | Should -Be '1'
         }
 
         It 'escapes quotes, backslashes and control characters, and keeps non-ASCII text' {
@@ -254,11 +365,19 @@ Describe 'ConvertTo-SanitizedIntuneExport' {
             $r.Json | Should -Not -Match '\\u003c'
         }
 
-        It 'writes DateTime values as ISO 8601 strings' {
+        It 'escapes control characters by code point and leaves soft hyphens and zero-width characters alone' {
+            $s = 'a' + [char]0x01 + 'b' + [char]0x1F + 'c' + [char]0x7F + 'd' + [char]0xAD + 'e' + [char]0x200B + 'f' + [char]0x08 + 'g'
+            $expected = '"a\u0001b\u001fc\u007fd' + [char]0xAD + 'e' + [char]0x200B + 'f\bg"'
+            Format-JsonString -Value $s | Should -Be $expected
+        }
+
+        It 'writes DateTime values as ISO 8601 strings in UTC' {
             $utc = [datetime]::new(2026, 3, 4, 5, 6, 7, [System.DateTimeKind]::Utc)
             ConvertTo-StableJson -Value $utc | Should -Be '"2026-03-04T05:06:07Z"'
             $unspecified = [datetime]::new(2026, 3, 4, 5, 6, 7, [System.DateTimeKind]::Unspecified)
             ConvertTo-StableJson -Value $unspecified | Should -Be '"2026-03-04T05:06:07"'
+            $local = [datetime]::new(2026, 3, 4, 5, 6, 7, [System.DateTimeKind]::Local)
+            ConvertTo-StableJson -Value $local | Should -Be ('"' + $local.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss') + 'Z"')
         }
 
         It 'round-trips as valid JSON and is idempotent' {
@@ -270,42 +389,69 @@ Describe 'ConvertTo-SanitizedIntuneExport' {
             $second.Context.Stats.ValuesReplaced | Should -Be 0
         }
 
-        It 'handles a top-level array' {
+        It 'handles top-level arrays of any length' {
             $r = Invoke-Sanitize -Json ('[ { "id": "' + $script:objectId + '", "name": "a" }, { "name": "b" } ]')
             $r.Json | Should -Be ('[' + "`n" + '  {' + "`n" + '    "name": "a"' + "`n" + '  },' + "`n" + '  {' + "`n" + '    "name": "b"' + "`n" + '  }' + "`n" + ']')
+            (Invoke-Sanitize -Json '[ { "name": "only" } ]').Json | Should -Be ('[' + "`n" + '  {' + "`n" + '    "name": "only"' + "`n" + '  }' + "`n" + ']')
+            (Invoke-Sanitize -Json '[]').Json | Should -Be '[]'
+            (Invoke-Sanitize -Json '[ "x" ]').Json | Should -Be ('[' + "`n" + '  "x"' + "`n" + ']')
         }
     }
 
     Context 'File mode' {
         BeforeEach {
             $script:work = Join-Path $TestDrive ([guid]::NewGuid().ToString('N'))
-            New-Item -ItemType Directory -Path (Join-Path $script:work 'exports' 'sub') -Force | Out-Null
-            Set-Content -LiteralPath (Join-Path $script:work 'exports' 'policy-a.json') -Value (Get-RawExportJson) -Encoding UTF8 -NoNewline
-            Set-Content -LiteralPath (Join-Path $script:work 'exports' 'sub' 'policy-b.json') -Value (Get-RawExportJson) -Encoding UTF8 -NoNewline
+            $script:exports = Join-Path $script:work 'exports'
+            New-Item -ItemType Directory -Path (Join-Path $script:exports 'sub') -Force | Out-Null
+            Set-Content -LiteralPath (Join-Path $script:exports 'policy-a.json') -Value (Get-RawExportJson) -Encoding UTF8 -NoNewline
+            Set-Content -LiteralPath (Join-Path (Join-Path $script:exports 'sub') 'policy-b.json') -Value (Get-RawExportJson) -Encoding UTF8 -NoNewline
+            $script:fileA = Join-Path $script:exports 'policy-a.json'
         }
 
-        It 'writes a sibling .sanitized.json by default and returns a summary' {
-            $file = Join-Path $script:work 'exports' 'policy-a.json'
-            $summary = & $script:scriptPath -Path $file -TenantId $script:tenant
-            $summary.Destination | Should -Be (Join-Path $script:work 'exports' 'policy-a.sanitized.json')
+        It 'writes a sibling .sanitized.json by default and returns a summary with review hints' {
+            $summary = & $script:scriptPath -Path $script:fileA -TenantId $script:tenant
+            $summary.Destination | Should -Be (Join-Path $script:exports 'policy-a.sanitized.json')
             Test-Path $summary.Destination | Should -BeTrue
             $summary.PropertiesRemoved | Should -BeGreaterThan 0
             $summary.ValuesReplaced | Should -BeGreaterThan 0
             $summary.Placeholders | Should -Contain '<TENANT-ID>'
+            @($summary.ReviewHints).Count | Should -BeGreaterThan 0
+            ($summary.ReviewHints -join "`n") | Should -Match 'templateId'
         }
 
         It 'mirrors folder structure under -OutputPath and skips .sanitized.json files' {
-            $out = Join-Path $script:work 'artifacts' 'policies' 'configuration'
-            Set-Content -LiteralPath (Join-Path $script:work 'exports' 'old.sanitized.json') -Value '{ "a": 1 }' -Encoding UTF8
-            $summaries = @(& $script:scriptPath -Path (Join-Path $script:work 'exports') -OutputPath $out -TenantId $script:tenant)
+            $out = Join-Path $script:work 'artifacts'
+            Set-Content -LiteralPath (Join-Path $script:exports 'old.sanitized.json') -Value '{ "a": 1 }' -Encoding UTF8
+            $summaries = @(& $script:scriptPath -Path $script:exports -OutputPath $out -TenantId $script:tenant)
             $summaries.Count | Should -Be 2
             Test-Path (Join-Path $out 'policy-a.json') | Should -BeTrue
-            Test-Path (Join-Path $out 'sub' 'policy-b.json') | Should -BeTrue
+            Test-Path (Join-Path (Join-Path $out 'sub') 'policy-b.json') | Should -BeTrue
+        }
+
+        It 'resolves relative -OutputPath and -NameMapPath against the PowerShell location' {
+            $map = Join-Path $script:work 'names.json'
+            Set-Content -LiteralPath $map -Value ('{ "groups": { "' + $script:group1 + '": "WIN-Ring-R1" } }') -Encoding UTF8
+            Push-Location $script:work
+            try {
+                $summary = & $script:scriptPath -Path 'exports/policy-a.json' -OutputPath 'out/relative' -NameMapPath 'names.json'
+                $summary.Destination | Should -Be (Join-Path (Join-Path $script:work 'out') (Join-Path 'relative' 'policy-a.json'))
+                Test-Path $summary.Destination | Should -BeTrue
+                (Get-Content $summary.Destination -Raw) | Should -Match '<GROUP:WIN-Ring-R1>'
+            } finally {
+                Pop-Location
+            }
+        }
+
+        It 'keeps a one-element top-level array an array and an empty array empty' {
+            Set-Content -LiteralPath (Join-Path $script:exports 'one.json') -Value ('[ { "id": "' + $script:objectId + '", "name": "only" } ]') -Encoding UTF8
+            Set-Content -LiteralPath (Join-Path $script:exports 'none.json') -Value '[]' -Encoding UTF8
+            & $script:scriptPath -Path (Join-Path $script:exports 'one.json'), (Join-Path $script:exports 'none.json') | Out-Null
+            (Get-Content (Join-Path $script:exports 'one.sanitized.json') -Raw) | Should -Be ('[' + "`n" + '  {' + "`n" + '    "name": "only"' + "`n" + '  }' + "`n" + ']' + "`n")
+            (Get-Content (Join-Path $script:exports 'none.sanitized.json') -Raw) | Should -Be ('[]' + "`n")
         }
 
         It 'writes UTF-8 without BOM and LF line endings' {
-            $file = Join-Path $script:work 'exports' 'policy-a.json'
-            $summary = & $script:scriptPath -Path $file
+            $summary = & $script:scriptPath -Path $script:fileA
             $bytes = [System.IO.File]::ReadAllBytes($summary.Destination)
             $bytes[0] | Should -Be ([byte][char]'{')
             ($bytes -contains 13) | Should -BeFalse
@@ -313,42 +459,46 @@ Describe 'ConvertTo-SanitizedIntuneExport' {
         }
 
         It '-InPlace overwrites the input' {
-            $file = Join-Path $script:work 'exports' 'policy-a.json'
-            $before = Get-Content $file -Raw
-            $summary = & $script:scriptPath -Path $file -InPlace
-            $summary.Destination | Should -Be $file
-            (Get-Content $file -Raw) | Should -Not -Be $before
-            (Get-Content $file -Raw) | Should -Not -Match 'createdDateTime'
+            $before = Get-Content $script:fileA -Raw
+            $summary = & $script:scriptPath -Path $script:fileA -InPlace
+            $summary.Destination | Should -Be $script:fileA
+            (Get-Content $script:fileA -Raw) | Should -Not -Be $before
+            (Get-Content $script:fileA -Raw) | Should -Not -Match 'createdDateTime'
         }
 
         It '-WhatIf writes nothing' {
-            $file = Join-Path $script:work 'exports' 'policy-a.json'
-            & $script:scriptPath -Path $file -WhatIf | Out-Null
-            Test-Path (Join-Path $script:work 'exports' 'policy-a.sanitized.json') | Should -BeFalse
+            & $script:scriptPath -Path $script:fileA -WhatIf | Out-Null
+            Test-Path (Join-Path $script:exports 'policy-a.sanitized.json') | Should -BeFalse
         }
 
         It 'rejects -InPlace together with -OutputPath, a non-GUID tenant id, and a missing path' {
-            $file = Join-Path $script:work 'exports' 'policy-a.json'
-            { & $script:scriptPath -Path $file -InPlace -OutputPath $script:work } | Should -Throw '*cannot be combined*'
-            { & $script:scriptPath -Path $file -TenantId 'not-a-guid' } | Should -Throw '*must be a GUID*'
+            { & $script:scriptPath -Path $script:fileA -InPlace -OutputPath $script:work } | Should -Throw '*cannot be combined*'
+            { & $script:scriptPath -Path $script:fileA -TenantId 'not-a-guid' } | Should -Throw '*must be a GUID*'
             { & $script:scriptPath -Path (Join-Path $script:work 'nope.json') } | Should -Throw '*not found*'
             { & $script:scriptPath } | Should -Throw '*Specify -Path*'
         }
 
-        It 'reads a name map file' {
+        It 'reads a name map file and rejects names that would break a placeholder' {
             $map = Join-Path $script:work 'names.json'
             Set-Content -LiteralPath $map -Value ('{ "groups": { "' + $script:group1 + '": "WIN-Ring-R1" }, "filters": { "' + $script:filter1 + '": "Corporate Windows" } }') -Encoding UTF8
-            $file = Join-Path $script:work 'exports' 'policy-a.json'
-            $obj = & $script:scriptPath -Path $file -NameMapPath $map -PassThru
+            $obj = & $script:scriptPath -Path $script:fileA -NameMapPath $map -PassThru
             $obj['assignments'][0]['target']['groupId'] | Should -Be '<GROUP:WIN-Ring-R1>'
             $obj['assignments'][0]['target']['deviceAndAppManagementAssignmentFilterId'] | Should -Be '<FILTER:Corporate Windows>'
+
+            $bad = Join-Path $script:work 'bad.json'
+            Set-Content -LiteralPath $bad -Value ('{ "groups": { "' + $script:group1 + '": "Ring>1" } }') -Encoding UTF8
+            { & $script:scriptPath -Path $script:fileA -NameMapPath $bad -WhatIf } | Should -Throw '*not allowed in a placeholder*'
+            Set-Content -LiteralPath $bad -Value ('{ "groups": { "not-a-guid": "x" } }') -Encoding UTF8
+            { & $script:scriptPath -Path $script:fileA -NameMapPath $bad -WhatIf } | Should -Throw '*not a GUID*'
+            Set-Content -LiteralPath $bad -Value ('{ "groups": { "' + $script:group1 + '": "owner kim@' + $script:realDomain + '.com" } }') -Encoding UTF8
+            { & $script:scriptPath -Path $script:fileA -NameMapPath $bad -WhatIf } | Should -Throw '*not allowed in a placeholder*'
         }
 
         It 'produces output that passes the sanitization guard, from input that fails it' {
-            $out = Join-Path $script:work 'artifacts' 'policies' 'configuration'
-            & $script:scriptPath -Path (Join-Path $script:work 'exports') -OutputPath $out -TenantId $script:tenant | Out-Null
+            $out = Join-Path (Join-Path (Join-Path $script:work 'artifacts') 'policies') 'configuration'
+            & $script:scriptPath -Path $script:exports -OutputPath $out -TenantId $script:tenant | Out-Null
 
-            $rawFindings = @(& $script:guardPath -Path (Join-Path $script:work 'exports') -Quiet)
+            $rawFindings = @(& $script:guardPath -Path $script:exports -Quiet)
             $rawFindings.Count | Should -BeGreaterThan 0
 
             $cleanFindings = @(& $script:guardPath -Path (Join-Path $script:work 'artifacts') -Quiet)
diff --git a/tests/Test-RepoSanitized.Tests.ps1 b/tests/Test-RepoSanitized.Tests.ps1
index 049a2c8..cbfcf40 100644
--- a/tests/Test-RepoSanitized.Tests.ps1
+++ b/tests/Test-RepoSanitized.Tests.ps1
@@ -90,10 +90,10 @@ Contact: admin@contoso.com or user@contoso.onmicrosoft.com
     }
 
     Context 'Identifiers' {
-        It 'flags a real tenant domain and allows contoso' {
-            Write-Fixture 'docs/t.md' 'Real: northwindtraders99.onmicrosoft.com and fake: contoso.onmicrosoft.com' | Out-Null
+        It 'flags a real tenant domain (also the .mail routing form) and allows placeholders' {
+            Write-Fixture 'docs/t.md' 'Real: northwindtraders99.onmicrosoft.com and northwindtraders99.mail.onmicrosoft.com; fake: contoso.onmicrosoft.com and <label>.mail.onmicrosoft.com' | Out-Null
             $r = Invoke-Guard | Where-Object Rule -eq 'TenantDomain'
-            $r.Count | Should -Be 1
+            $r.Count | Should -Be 2
         }
 
         It 'flags a real e-mail address and allows placeholder domains' {
@@ -102,6 +102,22 @@ Contact: admin@contoso.com or user@contoso.onmicrosoft.com
             $r.Count | Should -Be 1
         }
 
+        It 'flags guest, URL-encoded, non-ASCII and admin@ addresses on real domains' {
+            Write-Fixture 'docs/e2.md' ('guest kim_northwind99.com#EXT#@northwind99.onmicrosoft.com ; encoded kim.lee%40northwind99.com ; unicode kim.m' + [char]0x00FC + 'ller@northwind99.com ; admin@northwind99.com') | Out-Null
+            $r = Invoke-Guard | Where-Object Rule -eq 'EmailOrUpn'
+            $r.Count | Should -Be 4
+        }
+
+        It 'does not flag JSON keys that look like addresses (definition@odata.bind, settings@odata.context)' {
+            Write-Fixture 'artifacts/admx.json' '{ "definition@odata.bind": "https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions(''x'')", "settings@odata.context": "y" }' | Out-Null
+            (Invoke-Guard | Where-Object Rule -eq 'EmailOrUpn').Count | Should -Be 0
+        }
+
+        It 'flags secrets in JSON form and under Wi-Fi / VPN key names' {
+            Write-Fixture 'artifacts/secrets.json' ('{ "password": "' + ('P' * 20) + '", "preSharedKey": "' + ('K' * 20) + '", "sharedSecret": "<SECRET>" }') | Out-Null
+            (Invoke-Guard | Where-Object Rule -eq 'SecretAssignment').Count | Should -Be 2
+        }
+
         It 'flags a GUID in tenantId / groupId keys' {
             Write-Fixture 'docs/ids.json' ('{ "tenantId": "' + $script:realGuid + '", "target": { "groupId": "' + $script:realGuid + '" } }') | Out-Null
             (Invoke-Guard | Where-Object Rule -eq 'TenantObjectIdInJson').Count | Should -Be 2