DEV Community

Anthony Buhnerkemper
Anthony Buhnerkemper

Posted on

10 Free PowerShell 7 Toolkits for Microsoft 365 Admins

#powershell #microsoft365 #azure #security

I have worked in IT for about 20 years. Much of that time was MSP operations. Now I work as an M365 cloud admin.

Over the years I wrote the same scripts again and again. So I cleaned them up and put them on GitHub. They are free to use.

This post is a quick tour. Each toolkit gets one short paragraph and a link.

What they have in common

  • PowerShell 7.4 or later.
  • Current Microsoft modules (Microsoft.Graph SDK v2, ExchangeOnlineManagement v3, PnP.PowerShell, MicrosoftTeams, Az).
  • Comment-based help on every script. Run Get-Help ./script.ps1 -Full.
  • Reports export to CSV.
  • Change scripts support -WhatIf and -Confirm.
  • Certificate (app-only) or interactive sign-in.
  • No secrets in the repos. Examples use contoso.com and placeholder GUIDs.

Please test in a dev tenant first.

Getting started

Every repo ships the same Connect-M365Admin script. Dot-source it, then connect to what you need.

# Interactive sign-in
. ./scripts/Connect/Connect-M365Admin.ps1
Connect-M365Admin -Service Graph, ExchangeOnline -Interactive -ClientId 00000000-0000-0000-0000-000000000000

# Or app-only with a certificate, using environment variables
$env:M365_TENANT_ID       = '00000000-0000-0000-0000-000000000000'
$env:M365_CLIENT_ID       = '00000000-0000-0000-0000-000000000000'
$env:M365_CERT_THUMBPRINT = '0000000000000000000000000000000000000000'
$env:M365_ORGANIZATION    = 'contoso.onmicrosoft.com'
Connect-M365Admin -Service Graph, ExchangeOnline
Enter fullscreen mode Exit fullscreen mode

Services you can pass: Graph, ExchangeOnline, Purview, SharePoint, PnP, Teams, Azure. Call Disconnect-M365Admin when you are done.

The toolkits

Graph PowerShell 7 Admin Toolkit

This is the base. The connect pattern started here. It covers Entra ID security, Exchange Online and Purview reports. Try Get-ConditionalAccessReport.ps1 to review your CA policies. Get-MFARegistrationReport.ps1 shows who still needs MFA.

👉 graph-powershell7-admin-toolkit

Entra ID PowerShell Toolkit

User lifecycle, groups, licenses and sign-in logs. New-EntraUserFromCsv.ps1 onboards users with a Temporary Access Pass. Get-AppCredentialExpiryReport.ps1 finds app secrets and certs before they expire.

👉 entra-id-powershell-toolkit

Exchange Online PowerShell Toolkit

Mailbox inventory, permission audits and message trace. Get-InboxRuleForwardingAudit.ps1 finds rules that forward mail out. Get-SharedMailboxPermissionAudit.ps1 shows who can open each shared mailbox.

👉 exchange-online-powershell-toolkit

SharePoint Online PowerShell Toolkit

Uses PnP.PowerShell and the SPO module. It covers site inventory, sharing, permissions, storage and site lifecycle. Get-SPOExternalSharingAudit.ps1 shows what is shared outside. Get-SPOInactiveSites.ps1 helps you find sites to review or lock.

👉 sharepoint-online-powershell-toolkit

OneDrive PowerShell Toolkit

Inventory, storage, sharing and offboarding. Grant-DepartedUserOneDriveAccess.ps1 gives a manager access to a leaver's files. Get-OneDriveSharingAudit.ps1 lists shared files per user.

👉 onedrive-powershell-toolkit

Teams PowerShell Toolkit

Team inventory, owners, guests and policies. Get-OrphanedTeams.ps1 finds teams with no owner. Add-TeamOwnerToOrphanedTeam.ps1 fixes them.

👉 teams-powershell-toolkit

Intune PowerShell Toolkit

Devices, compliance, apps and Autopilot. Get-IntuneComplianceReport.ps1 shows which devices fail and why. Remove-IntuneStaleDevice.ps1 cleans up old devices, with -WhatIf first.

👉 intune-powershell-toolkit

Defender XDR PowerShell Toolkit

Uses the Graph security API. It covers incidents, alerts, device risk and Secure Score. Invoke-AdvancedHuntingQuery.ps1 runs KQL from the included hunting library. Get-MDEOnboardingStatus.ps1 shows which devices are not onboarded.

👉 defender-xdr-powershell-toolkit

Sentinel KQL Toolkit

Analytics rules as code, plus sample detections. Export-SentinelAnalyticsRule.ps1 backs up your rules. New-SentinelRuleFromKql.ps1 deploys a KQL file as a Scheduled rule. Sample detections include MFA fatigue and new Global Admin.

👉 sentinel-kql-toolkit

Purview Compliance Toolkit

Labels, DLP, retention, eDiscovery and audit search. Set-DlpPolicyMode.ps1 helps you roll out DLP in stages. Search-AuditLogReport.ps1 pulls unified audit log results to CSV.

👉 purview-compliance-toolkit

Wrap up

These scripts save me time every week. I hope they save you some too.

Issues, ideas and pull requests are welcome. You can find all of them on my GitHub profile.

What script do you run most often as an M365 admin? Tell me in the comments.

Top comments (0)