PowerShell for Microsoft Graph

Welcome to the home of PowerShell examples for Microsoft Graph – this repository is designed for administrators, developers, and IT professionals seeking to maximize the capabilities of Microsoft Graph within their PowerShell scripts. Whether you're automating Office 365 tasks, managing Entra ID resources, or integrating various Microsoft services, this repository aims to be a community driven go-to resource for scripts, modules, and best practices.

Getting Started

PowerShell SDK for Microsoft Graph

Install-Module Microsoft.Graph -AllowClobber -Force

Optionally, also install:

Install-Module Microsoft.Graph.Beta -AllowClobber -Force

Connect to Microsoft Graph

Using the Microsoft Graph Command Line Tools Enterprise Application

Connect-MgGraph -Scopes @('')

Using an existing Access Token

Connect-MgGraph -AccessToken (ConvertTo-SecureString 'ey..' -AsPlainText -Force)

Using an Application Registration (Platform: Mobile and desktop applications, redirect http://localhost)

Connect-MgGraph -ClientId 'abc..' -TenantId 'abc..'

Using a ClientId and Secret (Password)

$tenantId = ''
$clientId = ''
$secret = ConvertTo-SecureString '' -AsPlainText -Force
$secretCredential = New-Object System.Management.Automation.PSCredential ($clientId, $secret)
$params = @{
    'SecretCredential' = $secretCredential
    'TenantId'         = $tenantId
}
Connect-MgGraph @params

Audit Logs

Authentication Method Mismatch

This Entra ID error occurs when the authentication method by which the user authenticated with the service doesn't match the requested authentication method defined by the provider.

Conditional Access Policy Failures

Retrieving and storing current Conditional Access Policy sign-in failures.

Application Registrations

Disabled or Invalid

Find Application Registrations that have been disabled or are missing their Enterprise Application instance (Service Principal).

Credentials

Find Application Registrations with Password or Certificate Credentials.

Credentials Expired

Find Application Registration Certificate or Secret expiry status.

Without Owners

Find Application Registrations without assigned Owners.

Service Principals

Add Microsoft Graph App Role Assignment

Adding a Microsoft Graph App Role to a Service Principal (Application/Managed Identity). ie. 'User.Read.All'

Where Enterprise Application

Find all Enterprise Applications

Where Managed Identity

Find all Managed Identities

Where Microsoft Application

Find all Microsoft Applications

With AppRoles Assigned from AppId

Find all Enterprise Applications with the ability to consumer services in Microsoft Graph, AAD Graph and O365 API without a signed in user.

With SAML Expiry Status

Find SAML SSO expiry status on enabled Enterprise Applications.

Azure Automation Account

Acquire Access Token for Microsoft Graph

Retrieve an Access Token for Microsoft Graph from an Azure AD Automation Account Managed Identity.

Identity Protection

Confirm User Compromised

Confirm one or more riskyUser objects as compromised. This action sets the targeted user's risk level to high.

Groups

Cloud Only

Find all cloud only groups (those not synchronised from AD on-premises).

Users

Cloud Only

Find all cloud only accounts.

Guests

Find all Guest accounts.

Last Sign In Activity

Find the last sign-in activity of an account.

Members

Find all Member accounts.

Password Change

Make a cloud or on-premises user change their password on their next sign-in to Azure. This cannot be used in conjunction with Passthrough Authentication.

Where Assigned Licenses

Find all accounts assigned licenses.

Where Email Address Is Value

Find Member account by email address.

Where On-Premises Extension Attribute Is Value

Find all Member accounts by on-premises extensionAttribute.

Where UserPrincipalName Starts With

Find accounts by User Principal Name prefix.

Conditional Access

Policies

Find all Conditional Access Policies.

Templates

Zero Trust Persona-based Azure AD Conditional Access Policies

Red Team

Finding Global Administrators

Find accounts with the Global Administrator role using an access token acquired for the Azure Portal (Entra).

Finding Single Page Applications with Passwords

Find Application Registrations for Single Page Applications that contain secrets.

Miscellaneous

Client Credentials Flow

Obtaining an Access Token for Microsoft Graph using the Application Client Credentials grant using native PowerShell and the Invoke-RestMethod cmdlet.

Device Code Flow

Obtaining an Access Token for Microsoft Graph using the Device Code grant and PowerShell with the Invoke-RestMethod cmdlet.