BenutzerverwaltungUser Management

Connect-MgGraph -Scopes "User.Read.All"
Get-MgUser -Top 20 -Property DisplayName,UserType,OnPremisesSyncEnabled |
  Select-Object DisplayName, UserType, OnPremisesSyncEnabled

GET https://graph.microsoft.com/v1.0/users?$select=displayName,userType,onPremisesSyncEnabled&$top=20
Authorization: Bearer <token>

Connect-MgGraph -Scopes "User.ReadWrite.All"
$passwordProfile = @{
  Password = "Str0ng!TempP@ssw0rd"
  ForceChangePasswordNextSignIn = $true
}

New-MgUser `
  -DisplayName "Adele Vance" `
  -GivenName "Adele" `
  -Surname "Vance" `
  -MailNickname "adele.vance" `
  -UserPrincipalName "adele.vance@contoso.com" `
  -AccountEnabled `
  -UsageLocation "DE" `
  -PasswordProfile $passwordProfile

POST https://graph.microsoft.com/v1.0/users
Content-Type: application/json
Authorization: Bearer <token>

{
  "accountEnabled": true,
  "displayName": "Adele Vance",
  "givenName": "Adele",
  "surname": "Vance",
  "mailNickname": "adele.vance",
  "userPrincipalName": "adele.vance@contoso.com",
  "usageLocation": "DE",
  "jobTitle": "Cloud Administrator",
  "department": "IT",
  "officeLocation": "Berlin",
  "businessPhones": ["+49 30 5555 100"],
  "passwordProfile": {
    "forceChangePasswordNextSignIn": true,
    "password": "Str0ng!TempP@ssw0rd"
  }
}

Connect-MgGraph -Scopes "User.Read.All"
Get-MgUser -UserId "adele.vance@contoso.com" `
  -Property DisplayName,GivenName,Surname,Department,JobTitle,UsageLocation,EmployeeId,SignInActivity

GET https://graph.microsoft.com/v1.0/users/adele.vance@contoso.com?$select=displayName,givenName,surname,department,jobTitle,usageLocation,employeeId,signInActivity
Authorization: Bearer <token>

Connect-MgGraph -Scopes "User.ReadWrite.All"
Update-MgUser -UserId "adele.vance@contoso.com" `
  -JobTitle "Senior Cloud Administrator" `
  -Department "Platform Engineering" `
  -OfficeLocation "Munich" `
  -MobilePhone "+49 171 5550100"

PATCH https://graph.microsoft.com/v1.0/users/adele.vance@contoso.com
Content-Type: application/json
Authorization: Bearer <token>

{
  "jobTitle": "Senior Cloud Administrator",
  "department": "Platform Engineering",
  "officeLocation": "Munich",
  "mobilePhone": "+49 171 5550100"
}

Connect-MgGraph -Scopes "User.ReadWrite.All","Directory.AccessAsUser.All"
Remove-MgUser -UserId "adele.vance@contoso.com"
Get-MgDirectoryDeletedItemAsUser
Restore-MgDirectoryDeletedItem -DirectoryObjectId "<deleted-object-id>"

DELETE https://graph.microsoft.com/v1.0/users/adele.vance@contoso.com
GET https://graph.microsoft.com/v1.0/directory/deletedItems/microsoft.graph.user
POST https://graph.microsoft.com/v1.0/directory/deletedItems/<deleted-object-id>/restore
Authorization: Bearer <token>

Connect-MgGraph -Scopes "User.ReadWrite.All"
Update-MgUser -UserId "adele.vance@contoso.com" -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId "adele.vance@contoso.com"

PATCH https://graph.microsoft.com/v1.0/users/adele.vance@contoso.com
Content-Type: application/json
{ "accountEnabled": false }

POST https://graph.microsoft.com/v1.0/users/adele.vance@contoso.com/revokeSignInSessions
Authorization: Bearer <token>

Connect-MgGraph -Scopes "User.ReadWrite.All"
$passwordProfile = @{
  Password = "N3w!TempP@ssw0rd"
  ForceChangePasswordNextSignIn = $true
}
Update-MgUser -UserId "adele.vance@contoso.com" -PasswordProfile $passwordProfile

PATCH https://graph.microsoft.com/v1.0/users/adele.vance@contoso.com
Content-Type: application/json
Authorization: Bearer <token>

{
  "passwordProfile": {
    "password": "N3w!TempP@ssw0rd",
    "forceChangePasswordNextSignIn": true
  }
}

Connect-MgGraph -Scopes "User.ReadWrite.All"
$users = Import-Csv ".\new-users.csv"
$results = foreach ($u in $users) {
  try {
    $passwordProfile = @{
      Password = $u.Password
      ForceChangePasswordNextSignIn = $true
    }
    $created = New-MgUser -DisplayName $u.DisplayName -GivenName $u.GivenName -Surname $u.Surname -MailNickname $u.MailNickname -UserPrincipalName $u.UserPrincipalName -Department $u.Department -JobTitle $u.JobTitle -UsageLocation $u.UsageLocation -AccountEnabled -PasswordProfile $passwordProfile
    [pscustomobject]@{ UserPrincipalName = $u.UserPrincipalName; Status = "Created"; Id = $created.Id; Error = $null }
  } catch {
    [pscustomobject]@{ UserPrincipalName = $u.UserPrincipalName; Status = "Failed"; Id = $null; Error = $_.Exception.Message }
  }
}
$results | Export-Csv ".\new-users-results.csv" -NoTypeInformation -Encoding UTF8

POST https://graph.microsoft.com/v1.0/$batch
Content-Type: application/json
Authorization: Bearer <token>

{
  "requests": [
    {
      "id": "1",
      "method": "POST",
      "url": "/users",
      "headers": { "Content-Type": "application/json" },
      "body": {
        "accountEnabled": true,
        "displayName": "User One",
        "mailNickname": "user.one",
        "userPrincipalName": "user.one@contoso.com",
        "passwordProfile": {
          "forceChangePasswordNextSignIn": true,
          "password": "TempP@ssword1!"
        }
      }
    }
  ]
}

Connect-MgGraph -Scopes "User.Invite.All"
New-MgInvitation `
  -InvitedUserDisplayName "Partner User" `
  -InvitedUserEmailAddress "partner.user@fabrikam.com" `
  -InviteRedirectUrl "https://myapps.microsoft.com" `
  -SendInvitationMessage

POST https://graph.microsoft.com/v1.0/invitations
Content-Type: application/json
Authorization: Bearer <token>

{
  "invitedUserDisplayName": "Partner User",
  "invitedUserEmailAddress": "partner.user@fabrikam.com",
  "inviteRedirectUrl": "https://myapps.microsoft.com",
  "sendInvitationMessage": true
}

Connect-MgGraph -Scopes "User.ReadWrite.All","Organization.Read.All"
$sku = Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "ENTERPRISEPACK"
Set-MgUserLicense -UserId "adele.vance@contoso.com" -AddLicenses @{SkuId = $sku.SkuId} -RemoveLicenses @()

POST https://graph.microsoft.com/v1.0/users/adele.vance@contoso.com/assignLicense
Content-Type: application/json
Authorization: Bearer <token>

{
  "addLicenses": [
    { "skuId": "6fd2c87f-b296-42f0-b197-1e91e994b900" }
  ],
  "removeLicenses": []
}

Connect-MgGraph -Scopes "User.Read.All","AuditLog.Read.All"
$cutoff = (Get-Date).AddDays(-90)
Get-MgUser -All -Property DisplayName,UserPrincipalName,SignInActivity |
  Where-Object {
    -not $_.SignInActivity.LastSignInDateTime -or
    ([datetime]$_.SignInActivity.LastSignInDateTime -lt $cutoff)
  } |
  Select-Object DisplayName, UserPrincipalName,
    @{n='LastSignInDateTime';e={$_.SignInActivity.LastSignInDateTime}}

GET https://graph.microsoft.com/beta/users?$select=displayName,userPrincipalName,signInActivity
GET https://graph.microsoft.com/v1.0/auditLogs/signIns?$top=50
Authorization: Bearer <token>

Connect-MgGraph -Scopes "User.ReadWrite.All"
Set-MgUserManagerByRef -UserId "adele.vance@contoso.com" -BodyParameter @{
  "@odata.id" = "https://graph.microsoft.com/v1.0/users/<manager-object-id>"
}
Get-MgUserManager -UserId "adele.vance@contoso.com"
Get-MgUserDirectReport -UserId "<manager-object-id>"

PUT https://graph.microsoft.com/v1.0/users/adele.vance@contoso.com/manager/$ref
Content-Type: application/json
Authorization: Bearer <token>

{
  "@odata.id": "https://graph.microsoft.com/v1.0/users/<manager-object-id>"
}

GET https://graph.microsoft.com/v1.0/users/adele.vance@contoso.com/manager
GET https://graph.microsoft.com/v1.0/users/<manager-object-id>/directReports

Connect-MgGraph -Scopes "User.Read.All"
Get-MgUser -Filter "department eq 'IT'" -ConsistencyLevel eventual -CountVariable count `
  -Search '"displayName:Adele"' -Top 25
$count

GET https://graph.microsoft.com/v1.0/users?$filter=department eq 'IT'&$search="displayName:Adele"&$count=true&$top=25
ConsistencyLevel: eventual
Authorization: Bearer <token>

Connect-MgGraph -Scopes "CustomSecAttributeDefinition.ReadWrite.All","CustomSecAttributeAssignment.ReadWrite.All"

$attributeSetBody = @{
  id = "hr"
  description = "HR master data"
  maxAttributesPerSet = 25
}

Invoke-MgGraphRequest -Method POST `
  -Uri "https://graph.microsoft.com/v1.0/directory/customSecurityAttributeDefinitions" `
  -Body @{
    attributeSet = "hr"
    name = "employmentCategory"
    type = "String"
    isCollection = $false
    status = "Available"
    usePreDefinedValuesOnly = $true
    allowedValues = @(
      @{ id = "employee"; isActive = $true },
      @{ id = "contractor"; isActive = $true },
      @{ id = "intern"; isActive = $true }
    )
  } | ConvertTo-Json -Depth 6

PATCH https://graph.microsoft.com/v1.0/users/alice@contoso.com
Content-Type: application/json

{
  "customSecurityAttributes": {
    "hr": {
      "@odata.type": "#Microsoft.DirectoryServices.CustomSecurityAttributeValue",
      "employmentCategory": "contractor",
      "privilegedProject": true
    }
  }
}

POST https://graph.microsoft.com/v1.0/schemaExtensions
Content-Type: application/json

{
  "id": "contosoHrProfile",
  "description": "Contoso HR metadata",
  "targetTypes": ["User"],
  "properties": [
    { "name": "personnelArea", "type": "String" },
    { "name": "worksCouncilRelevant", "type": "Boolean" }
  ],
  "status": "InDevelopment"
}

Connect-MgGraph -Scopes `
  "User.ReadWrite.All",`
  "Directory.ReadWrite.All",`
  "AuditLog.Read.All",`
  "UserAuthenticationMethod.ReadWrite.All",`
  "Group.ReadWrite.All",`
  "Organization.Read.All"

$userId = "leaver@contoso.com"
$timestamp = Get-Date -Format "yyyyMMdd-HHmmss"
$archivePath = ".\offboarding-$timestamp"
New-Item -ItemType Directory -Path $archivePath -Force | Out-Null

$user = Get-MgUser -UserId $userId -Property DisplayName,UserPrincipalName,AssignedLicenses,AccountEnabled
$groups = Get-MgUserMemberOf -UserId $userId -All
$methods = Get-MgUserAuthenticationMethod -UserId $userId
$licenseDetails = Get-MgUserLicenseDetail -UserId $userId

$user | ConvertTo-Json -Depth 5 | Set-Content "$archivePath\user.json"
$groups | ConvertTo-Json -Depth 5 | Set-Content "$archivePath\groups.json"
$methods | ConvertTo-Json -Depth 5 | Set-Content "$archivePath\auth-methods.json"
$licenseDetails | ConvertTo-Json -Depth 5 | Set-Content "$archivePath\licenses.json"

Update-MgUser -UserId $userId -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $userId

foreach ($method in $methods) {
  if ($method.AdditionalProperties['@odata.type'] -like '*phoneAuthenticationMethod') {
    Remove-MgUserAuthenticationPhoneMethod -UserId $userId -PhoneAuthenticationMethodId $method.Id
  }
}

$removeLicenses = @($user.AssignedLicenses.SkuId)
if ($removeLicenses.Count -gt 0) {
  Set-MgUserLicense -UserId $userId -AddLicenses @() -RemoveLicenses $removeLicenses
}

foreach ($group in $groups) {
  if ($group.'@odata.type' -eq '#microsoft.graph.group') {
    Remove-MgGroupMemberByRef -GroupId $group.Id -DirectoryObjectId $user.Id -ErrorAction SilentlyContinue
  }
}

[pscustomobject]@{
  User = $user.UserPrincipalName
  Disabled = $true
  SessionRevoked = $true
  LicenseCountRemoved = $removeLicenses.Count
  GroupMembershipsProcessed = $groups.Count
  EvidencePath = (Resolve-Path $archivePath).Path
}

GET https://graph.microsoft.com/v1.0/users/{id}/authentication/methods
GET https://graph.microsoft.com/v1.0/users/{id}/authentication/phoneMethods
GET https://graph.microsoft.com/v1.0/users/{id}/authentication/fido2Methods
DELETE https://graph.microsoft.com/v1.0/users/{id}/authentication/microsoftAuthenticatorMethods/{methodId}

Connect-MgGraph -Scopes "UserAuthenticationMethod.Read.All","Reports.Read.All"

$registrationReport = Get-MgReportAuthenticationMethodUserRegistrationDetail -All |
  Select-Object UserPrincipalName, IsMfaRegistered, IsSsprRegistered,
                MethodsRegistered, IsPasswordlessCapable, DefaultMfaMethod

$registrationReport | Export-Csv ".\auth-registration-report.csv" -NoTypeInformation -Encoding UTF8

Connect-MgGraph -Scopes "AuditLog.Read.All"

$since = (Get-Date).AddDays(-7).ToString("s") + "Z"
$uri = "https://graph.microsoft.com/v1.0/auditLogs/signIns?$filter=createdDateTime ge $since&$top=1000"
$results = @()

do {
  $page = Invoke-MgGraphRequest -Method GET -Uri $uri
  $results += $page.value | Select-Object createdDateTime,userPrincipalName,appDisplayName,
                                      ipAddress,conditionalAccessStatus,riskLevelAggregated,
                                      isInteractive,@{n='FailureReason';e={$_.status.failureReason}}
  $uri = $page.'@odata.nextLink'
} while ($uri)

$results | Export-Csv ".\signin-export.csv" -NoTypeInformation -Encoding UTF8

$results |
  Group-Object conditionalAccessStatus |
  Sort-Object Count -Descending