Microsoft Graph and PowerShell 7: A Free Admin Toolkit for M365 Security

I have worked in IT for about 20 years. A lot of that was MSP operations. Today I work as an M365 cloud admin.

I kept writing the same scripts. So I cleaned them up and shared them on GitHub. This toolkit is the base for all my other M365 toolkits. The shared connect script started here.

Repo: graph-powershell7-admin-toolkit

The problem it solves

Many admin scripts online still use old modules. AzureAD and MSOnline are retired. Old scripts break or ask for basic auth.

I wanted one clean starting point. Use PowerShell 7. Use Microsoft.Graph SDK v2 and ExchangeOnlineManagement v3. Use certificates for automation. Keep secrets out of the code.

The repo also has six step-by-step docs. They cover install, app registration with a certificate, delegated vs app-only sign-in, Exchange and Purview connections, least privilege, and troubleshooting.

Highlight scripts

Get-ConditionalAccessReport.ps1

Exports all Conditional Access policies to CSV. Add -IncludeJson to keep the raw policy JSON too. Great for change reviews and backups.

./Get-ConditionalAccessReport.ps1 -IncludeJson

Get-MFARegistrationReport.ps1

Shows MFA and authentication method registration for every user. Use it to find people who still have no strong method.

./Get-MFARegistrationReport.ps1

Get-StaleGuestUsers.ps1

Finds guest accounts with no sign-in for a set number of days. A simple way to start guest clean-up.

./Get-StaleGuestUsers.ps1 -DaysInactive 120

Other scripts cover Secure Score, security defaults, privileged roles, mailbox security, anti-phish policies, transport rules, DLP, retention, sensitivity labels and content search export.

How the scripts are built

• PowerShell 7.4 or later.
• Comment-based help on every script. Run Get-Help ./script.ps1 -Full.
• Reports export to CSV.
• Change scripts support -WhatIf and -Confirm.
• Certificate (app-only) or interactive sign-in.
• No secrets in the repo. Examples use contoso.com and placeholder GUIDs.

Please test in a dev or test tenant first. Read each script before you run it.

My usual workflow

I start with the reports. They are read-only and safe. I open the CSV in Excel and look for anything odd.

Then I pick one fix. I run the change script with -WhatIf and read the output. If it looks right, I run it again for real.

For jobs I repeat, I use a certificate and schedule the script. That way nobody has to remember to run it.

Getting started

Clone the repo:

git clone https://github.com/anthonybuhnerkemper/graph-powershell7-admin-toolkit.git
cd graph-powershell7-admin-toolkit

Every toolkit ships the same Connect-M365Admin script. Dot-source it, then connect.

# Interactive sign-in
. ./scripts/Connect/Connect-M365Admin.ps1
Connect-M365Admin -Service Graph, ExchangeOnline -Interactive -ClientId 00000000-0000-0000-0000-000000000000

# Or app-only with a certificate
$env:M365_TENANT_ID       = '00000000-0000-0000-0000-000000000000'
$env:M365_CLIENT_ID       = '00000000-0000-0000-0000-000000000000'
$env:M365_CERT_THUMBPRINT = '0000000000000000000000000000000000000000'
Connect-M365Admin -Service Graph, ExchangeOnline

Run a report, check the CSV, then call Disconnect-M365Admin when you are done. The README lists the modules and roles each script needs.

More toolkits

I have nine more free toolkits that use the same pattern: entra-id-powershell-toolkit, exchange-online-powershell-toolkit, sharepoint-online-powershell-toolkit, onedrive-powershell-toolkit, teams-powershell-toolkit, intune-powershell-toolkit, defender-xdr-powershell-toolkit, sentinel-kql-toolkit, purview-compliance-toolkit.

You can find them all on my GitHub profile.

Feedback welcome

Issues, ideas and pull requests are welcome. What would you add? Tell me in the comments.