PowerShell-ReferenzPowerShell Reference

PowerShellPowerShell KopierenCopy

Install-Module Microsoft.Graph -Scope CurrentUser
Import-Module Microsoft.Graph
Connect-MgGraph -Scopes "User.Read.All","Group.Read.All","AuditLog.Read.All"
Get-MgContext

PowerShellPowerShell KopierenCopy

Connect-MgGraph -TenantId $TenantId -ClientId $AppId -CertificateThumbprint $Thumbprint
Get-MgContext
Get-MgApplication -Top 5

PowerShellPowerShell KopierenCopy

$clientSecret = ConvertTo-SecureString $env:GRAPH_CLIENT_SECRET -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential($AppId, $clientSecret)
Connect-MgGraph -TenantId $TenantId -ClientSecretCredential $credential
Get-MgServicePrincipal -Top 5

PowerShellPowerShell KopierenCopy

Find-MgGraphCommand -Command Get-MgUser
Find-MgGraphCommand -Uri "/users/{id}/memberOf"
Find-MgGraphPermission -SearchString "Conditional Access"

PowerShellPowerShell KopierenCopy

Install-Module ExchangeOnlineManagement -Scope CurrentUser
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com
Get-ConnectionInformation

PowerShellPowerShell KopierenCopy

Connect-SPOService -Url https://contoso-admin.sharepoint.com
Get-SPOSite -Limit All

PowerShellPowerShell KopierenCopy

Connect-MicrosoftTeams
Get-CsTenant

PowerShellPowerShell KopierenCopy

$tenantId = "contoso.onmicrosoft.com"
$adminUpn = "admin@contoso.com"
$spoAdminUrl = "https://contoso-admin.sharepoint.com"
$siteUrl = "https://contoso.sharepoint.com/sites/Operations"

Import-Module Microsoft.Graph
Import-Module ExchangeOnlineManagement
Import-Module Microsoft.Online.SharePoint.PowerShell
Import-Module PnP.PowerShell
Import-Module MicrosoftTeams

Connect-MgGraph -Scopes "User.Read.All","Group.Read.All","Directory.Read.All","AuditLog.Read.All"
Connect-ExchangeOnline -UserPrincipalName $adminUpn
Connect-SPOService -Url $spoAdminUrl
Connect-PnPOnline -Url $siteUrl -Interactive
Connect-MicrosoftTeams

Write-Host "Graph context:" (Get-MgContext).TenantId
Write-Host "Exchange connected:" ((Get-ConnectionInformation).State -join ", ")
Write-Host "Teams tenant:" (Get-CsTenant).DisplayName

PowerShellPowerShell KopierenCopy

$properties = @(
    "id","displayName","givenName","surname","userPrincipalName","mail",
    "department","jobTitle","officeLocation","accountEnabled","usageLocation",
    "city","country","mobilePhone","businessPhones","onPremisesSyncEnabled"
)

Connect-MgGraph -Scopes "User.Read.All"
$users = Get-MgUser -All -Property $properties

$report = foreach ($user in $users) {
    [pscustomobject]@{
        Id                   = $user.Id
        DisplayName          = $user.DisplayName
        GivenName            = $user.GivenName
        Surname              = $user.Surname
        UserPrincipalName    = $user.UserPrincipalName
        Mail                 = $user.Mail
        Department           = $user.Department
        JobTitle             = $user.JobTitle
        OfficeLocation       = $user.OfficeLocation
        AccountEnabled       = $user.AccountEnabled
        UsageLocation        = $user.UsageLocation
        City                 = $user.City
        Country              = $user.Country
        MobilePhone          = $user.MobilePhone
        OnPremisesSyncEnabled= $user.OnPremisesSyncEnabled
    }
}

$report | Export-Csv .\all-users.csv -NoTypeInformation -Encoding UTF8

PowerShellPowerShell KopierenCopy

Connect-MgGraph -Scopes "User.Read.All","AuditLog.Read.All"
Select-MgProfile -Name beta
$cutoff = (Get-Date).AddDays(-90)
$users = Get-MgUser -All -Property "displayName,userPrincipalName,accountEnabled,signInActivity"

$inactive = foreach ($user in $users) {
    $last = $null
    if ($user.SignInActivity.lastSignInDateTime) {
        $last = [datetime]$user.SignInActivity.lastSignInDateTime
    }

    if (-not $last -or $last -lt $cutoff) {
        [pscustomobject]@{
            DisplayName       = $user.DisplayName
            UserPrincipalName = $user.UserPrincipalName
            AccountEnabled    = $user.AccountEnabled
            LastSignIn        = $last
            DaysInactive      = if ($last) { ((Get-Date) - $last).Days } else { $null }
        }
    }
}

$inactive | Sort-Object DaysInactive -Descending | Export-Csv .\inactive-users.csv -NoTypeInformation

PowerShellPowerShell KopierenCopy

Connect-MgGraph -Scopes "User.ReadWrite.All"
$users = Import-Csv .\new-users.csv

foreach ($row in $users) {
    $passwordProfile = @{
        forceChangePasswordNextSignIn = $true
        password = $row.InitialPassword
    }

    New-MgUser -AccountEnabled:$true `
        -DisplayName $row.DisplayName `
        -GivenName $row.GivenName `
        -Surname $row.Surname `
        -MailNickname $row.MailNickname `
        -UserPrincipalName $row.UserPrincipalName `
        -Department $row.Department `
        -JobTitle $row.JobTitle `
        -UsageLocation $row.UsageLocation `
        -PasswordProfile $passwordProfile

    Write-Host "Created $($row.UserPrincipalName)"
}

PowerShellPowerShell KopierenCopy

Connect-MgGraph -Scopes "Group.Read.All","GroupMember.Read.All"
$groups = Get-MgGroup -All -Property "id,displayName,groupTypes,mail,mailEnabled,securityEnabled"
$rows = foreach ($group in $groups) {
    $members = Get-MgGroupMember -GroupId $group.Id -All
    foreach ($member in $members) {
        [pscustomobject]@{
            GroupId          = $group.Id
            GroupDisplayName = $group.DisplayName
            GroupMail        = $group.Mail
            SecurityEnabled  = $group.SecurityEnabled
            MailEnabled      = $group.MailEnabled
            MemberId         = $member.Id
            MemberType       = $member.AdditionalProperties['@odata.type']
        }
    }
}
$rows | Export-Csv .\groups-and-members.csv -NoTypeInformation -Encoding UTF8

PowerShellPowerShell KopierenCopy

Connect-MgGraph -Scopes "User.Read.All","Organization.Read.All"
$skuMap = @{}
Get-MgSubscribedSku -All | ForEach-Object {
    $skuMap[$_.SkuId.Guid] = $_.SkuPartNumber
}

$users = Get-MgUser -All -Property "displayName,userPrincipalName,assignedLicenses,usageLocation"
$report = foreach ($user in $users) {
    [pscustomobject]@{
        DisplayName       = $user.DisplayName
        UserPrincipalName = $user.UserPrincipalName
        UsageLocation     = $user.UsageLocation
        Licenses          = ($user.AssignedLicenses.SkuId.Guid | ForEach-Object { $skuMap[$_] }) -join '; '
        LicenseCount      = $user.AssignedLicenses.Count
    }
}
$report | Export-Csv .\license-assignment-report.csv -NoTypeInformation

PowerShellPowerShell KopierenCopy

Connect-MgGraph -Scopes "Reports.Read.All"
$rows = Get-MgReportAuthenticationMethodUserRegistrationDetail -All

$report = $rows | Select-Object `
    UserPrincipalName,
    UserDisplayName,
    IsMfaRegistered,
    IsSsprRegistered,
    IsPasswordlessCapable,
    IsAdmin,
    DefaultMfaMethod,
    MethodsRegistered

$report | Export-Csv .\mfa-registration-status.csv -NoTypeInformation -Encoding UTF8

PowerShellPowerShell KopierenCopy

Connect-MgGraph -Scopes "Policy.Read.All"
$policies = Get-MgIdentityConditionalAccessPolicy -All

$export = foreach ($policy in $policies) {
    [pscustomobject]@{
        Id          = $policy.Id
        DisplayName = $policy.DisplayName
        State       = $policy.State
        Conditions  = $policy.Conditions
        GrantControls = $policy.GrantControls
        SessionControls = $policy.SessionControls
    }
}

$export | ConvertTo-Json -Depth 20 | Set-Content .\conditional-access-policies.json -Encoding UTF8

PowerShellPowerShell KopierenCopy

Connect-ExchangeOnline -UserPrincipalName admin@contoso.com
$mailboxes = Get-EXOMailbox -ResultSize Unlimited
$report = foreach ($mailbox in $mailboxes) {
    $permissions = Get-MailboxPermission -Identity $mailbox.UserPrincipalName |
        Where-Object { $_.User -notlike 'NT AUTHORITY*' -and -not $_.IsInherited }

    foreach ($permission in $permissions) {
        [pscustomobject]@{
            Mailbox     = $mailbox.UserPrincipalName
            Trustee     = $permission.User
            AccessRights= ($permission.AccessRights -join ', ')
            Deny        = $permission.Deny
        }
    }
}
$report | Export-Csv .\mailbox-permissions.csv -NoTypeInformation -Encoding UTF8

PowerShellPowerShell KopierenCopy

Connect-ExchangeOnline -UserPrincipalName admin@contoso.com
$sharedMailboxes = Get-EXOMailbox -RecipientTypeDetails SharedMailbox -ResultSize Unlimited

$report = foreach ($mailbox in $sharedMailboxes) {
    $stats = Get-EXOMailboxStatistics -Identity $mailbox.UserPrincipalName
    [pscustomobject]@{
        DisplayName          = $mailbox.DisplayName
        PrimarySmtpAddress   = $mailbox.PrimarySmtpAddress
        HiddenFromAddressList= $mailbox.HiddenFromAddressListsEnabled
        LitigationHold       = $mailbox.LitigationHoldEnabled
        ArchiveStatus        = $mailbox.ArchiveStatus
        ItemCount            = $stats.ItemCount
        TotalItemSize        = $stats.TotalItemSize
        LastLogonTime        = $stats.LastLogonTime
    }
}
$report | Export-Csv .\shared-mailbox-report.csv -NoTypeInformation -Encoding UTF8

PowerShellPowerShell KopierenCopy

Connect-MgGraph -Scopes "User.Read.All","AuditLog.Read.All"
Select-MgProfile -Name beta
$guests = Get-MgUser -All -Filter "userType eq 'Guest'" -Property "displayName,userPrincipalName,mail,createdDateTime,signInActivity"

$report = foreach ($guest in $guests) {
    [pscustomobject]@{
        DisplayName       = $guest.DisplayName
        UserPrincipalName = $guest.UserPrincipalName
        Mail              = $guest.Mail
        CreatedDateTime   = $guest.CreatedDateTime
        LastSignIn        = $guest.SignInActivity.lastSignInDateTime
    }
}

$report | Export-Csv .\guest-users-last-signin.csv -NoTypeInformation -Encoding UTF8

PowerShellPowerShell KopierenCopy

Connect-MgGraph -Scopes "Device.ReadWrite.All","DeviceManagementManagedDevices.Read.All"
$cutoff = (Get-Date).AddDays(-120)
$devices = Get-MgDevice -All -Property "id,displayName,approximateLastSignInDateTime,accountEnabled"

$stale = $devices | Where-Object {
    $_.ApproximateLastSignInDateTime -and ([datetime]$_.ApproximateLastSignInDateTime) -lt $cutoff
}

$stale | Select-Object Id, DisplayName, ApproximateLastSignInDateTime, AccountEnabled |
    Export-Csv .\stale-devices.csv -NoTypeInformation

# Review CSV first, then uncomment the next line for cleanup
# $stale | ForEach-Object { Update-MgDevice -DeviceId $_.Id -AccountEnabled:$false }

PowerShellPowerShell KopierenCopy

Connect-MgGraph -Scopes "User.ReadWrite.All","Organization.Read.All"
$skuMap = Get-MgSubscribedSku -All | Group-Object SkuPartNumber -AsHashTable -AsString
$rows = Import-Csv .\license-assignments.csv

foreach ($row in $rows) {
    $sku = $skuMap[$row.SkuPartNumber]
    if (-not $sku) {
        Write-Warning "SKU $($row.SkuPartNumber) not found"
        continue
    }

    $body = @{
        addLicenses = @(@{ skuId = $sku.SkuId })
        removeLicenses = @()
    }

    Set-MgUserLicense -UserId $row.UserPrincipalName -BodyParameter $body
    Write-Host "Assigned $($row.SkuPartNumber) to $($row.UserPrincipalName)"
}

PowerShellPowerShell KopierenCopy

$groupAId = "11111111-1111-1111-1111-111111111111"
$groupBId = "22222222-2222-2222-2222-222222222222"
Connect-MgGraph -Scopes "GroupMember.Read.All"

$groupA = Get-MgGroupMember -GroupId $groupAId -All | Select-Object -ExpandProperty Id
$groupB = Get-MgGroupMember -GroupId $groupBId -All | Select-Object -ExpandProperty Id

$onlyA = $groupA | Where-Object { $_ -notin $groupB }
$onlyB = $groupB | Where-Object { $_ -notin $groupA }

[pscustomobject]@{ Comparison = "OnlyInA"; Count = $onlyA.Count }
[pscustomobject]@{ Comparison = "OnlyInB"; Count = $onlyB.Count }

$onlyA | Set-Content .\group-a-only.txt
$onlyB | Set-Content .\group-b-only.txt

PowerShellPowerShell KopierenCopy

Connect-MgGraph -Scopes "Application.Read.All"
$applications = Get-MgApplication -All -Property "id,displayName,passwordCredentials,keyCredentials"
$today = Get-Date

$report = foreach ($app in $applications) {
    foreach ($secret in $app.PasswordCredentials) {
        [pscustomobject]@{
            AppDisplayName = $app.DisplayName
            AppId          = $app.Id
            CredentialType = "ClientSecret"
            EndDateTime    = $secret.EndDateTime
            DaysRemaining  = ([datetime]$secret.EndDateTime - $today).Days
        }
    }
}

$report | Sort-Object DaysRemaining | Export-Csv .\app-secret-expiry.csv -NoTypeInformation

PowerShellPowerShell KopierenCopy

Connect-MgGraph -Scopes "AuditLog.Read.All","User.Read.All"
$since = (Get-Date).AddDays(-30)
$signIns = Get-MgAuditLogSignIn -All -Filter "createdDateTime ge $($since.ToString("s"))Z"

$report = $signIns | Group-Object UserPrincipalName | ForEach-Object {
    $latest = $_.Group | Sort-Object CreatedDateTime -Descending | Select-Object -First 1
    [pscustomobject]@{
        UserPrincipalName = $_.Name
        SignInCount       = $_.Count
        LastSignIn        = $latest.CreatedDateTime
        LastApp           = $latest.AppDisplayName
        LastIpAddress     = $latest.IpAddress
        LastStatus        = $latest.Status.ErrorCode
    }
}

$report | Export-Csv .\user-signin-activity.csv -NoTypeInformation -Encoding UTF8

PowerShellPowerShell KopierenCopy

param(
    [string]$OutputFolder = ".\ca-policy-backup"
)

try {
    # Load module and connect to Microsoft Graph
    Import-Module Microsoft.Graph.Identity.SignIns -ErrorAction Stop
    Connect-MgGraph -Scopes "Policy.Read.All" -NoWelcome -ErrorAction Stop

    if (-not (Test-Path $OutputFolder)) {
        New-Item -Path $OutputFolder -ItemType Directory -Force | Out-Null
    }

    $policies = Get-MgIdentityConditionalAccessPolicy -All -ErrorAction Stop
    $inventory = foreach ($policy in $policies) {
        $safeName = ($policy.DisplayName -replace '[^a-zA-Z0-9-_ ]','_').Trim()
        $jsonPath = Join-Path $OutputFolder "$safeName.json"

        # Persist full object for restore or diff scenarios
        $policy | ConvertTo-Json -Depth 25 | Set-Content -Path $jsonPath -Encoding UTF8

        [pscustomobject]@{
            DisplayName = $policy.DisplayName
            Id          = $policy.Id
            State       = $policy.State
            OutputFile  = $jsonPath
        }
    }

    $inventory | Export-Csv (Join-Path $OutputFolder 'ca-policy-inventory.csv') -NoTypeInformation -Encoding UTF8
}
catch {
    Write-Error "Conditional Access backup failed: $($_.Exception.Message)"
    throw
}
finally {
    Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
}

PowerShellPowerShell KopierenCopy

param(
    [int]$InactiveDays = 180,
    [switch]$RemoveAccounts,
    [string]$OutputPath = ".\stale-guest-users.csv"
)

try {
    # Connect and load all guest users with sign-in activity
    Import-Module Microsoft.Graph.Users, Microsoft.Graph.Identity.SignIns -ErrorAction Stop
    Connect-MgGraph -Scopes "User.Read.All","AuditLog.Read.All","User.ReadWrite.All" -NoWelcome -ErrorAction Stop

    $cutoff = (Get-Date).AddDays(-$InactiveDays)
    $guests = Get-MgUser -All -Filter "userType eq 'Guest'" -Property Id,DisplayName,UserPrincipalName,CreatedDateTime,SignInActivity

    $staleGuests = $guests | Where-Object {
        -not $_.SignInActivity.LastSignInDateTime -or ([datetime]$_.SignInActivity.LastSignInDateTime) -lt $cutoff
    } | Select-Object DisplayName, UserPrincipalName, CreatedDateTime,
        @{Name='LastSignInDateTime';Expression={$_.SignInActivity.LastSignInDateTime}},
        @{Name='DaysInactive';Expression={ if ($_.SignInActivity.LastSignInDateTime) { ((Get-Date) - [datetime]$_.SignInActivity.LastSignInDateTime).Days } else { 9999 } }}

    $staleGuests | Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8

    if ($RemoveAccounts) {
        foreach ($guest in $staleGuests) {
            # Remove only after review and explicit switch usage
            Remove-MgUser -UserId $guest.UserPrincipalName -ErrorAction Stop
        }
    }
}
catch {
    Write-Error "Guest cleanup failed: $($_.Exception.Message)"
    throw
}
finally {
    Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
}

PowerShellPowerShell KopierenCopy

param(
    [int[]]$ThresholdDays = @(30,60,90),
    [string]$OutputPath = ".\app-secret-expiry-report.csv"
)

try {
    # Load applications and inspect password credentials
    Import-Module Microsoft.Graph.Applications -ErrorAction Stop
    Connect-MgGraph -Scopes "Application.Read.All" -NoWelcome -ErrorAction Stop

    $today = Get-Date
    $maxThreshold = ($ThresholdDays | Measure-Object -Maximum).Maximum
    $applications = Get-MgApplication -All -Property Id,DisplayName,AppId,PasswordCredentials

    $report = foreach ($app in $applications) {
        foreach ($secret in $app.PasswordCredentials) {
            $daysRemaining = ([datetime]$secret.EndDateTime - $today).Days
            if ($daysRemaining -le $maxThreshold) {
                [pscustomobject]@{
                    DisplayName   = $app.DisplayName
                    ApplicationId = $app.AppId
                    ObjectId      = $app.Id
                    SecretName    = $secret.DisplayName
                    EndDateTime   = $secret.EndDateTime
                    DaysRemaining = $daysRemaining
                    Bucket        = ($ThresholdDays | Where-Object { $daysRemaining -le $_ } | Sort-Object | Select-Object -First 1)
                }
            }
        }
    }

    $report | Sort-Object DaysRemaining | Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8
}
catch {
    Write-Error "Secret expiry report failed: $($_.Exception.Message)"
    throw
}
finally {
    Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
}

PowerShellPowerShell KopierenCopy

param(
    [Parameter(Mandatory)]
    [string]$BeforeSnapshot,
    [Parameter(Mandatory)]
    [string]$AfterSnapshot,
    [string]$OutputPath = ".\group-membership-delta.csv"
)

try {
    # Import two snapshots and compare member state per group
    $before = Import-Csv $BeforeSnapshot -ErrorAction Stop
    $after  = Import-Csv $AfterSnapshot -ErrorAction Stop

    $delta = foreach ($groupId in ($after.GroupId + $before.GroupId | Sort-Object -Unique)) {
        $beforeMembers = $before | Where-Object GroupId -eq $groupId | Select-Object -ExpandProperty MemberUPN
        $afterMembers  = $after  | Where-Object GroupId -eq $groupId | Select-Object -ExpandProperty MemberUPN
        $groupName = ($after | Where-Object GroupId -eq $groupId | Select-Object -ExpandProperty GroupName -First 1)
        if (-not $groupName) {
            $groupName = ($before | Where-Object GroupId -eq $groupId | Select-Object -ExpandProperty GroupName -First 1)
        }

        Compare-Object -ReferenceObject $beforeMembers -DifferenceObject $afterMembers -PassThru | ForEach-Object {
            [pscustomobject]@{
                GroupId    = $groupId
                GroupName  = $groupName
                MemberUPN  = $_
                ChangeType = if ($_.SideIndicator -eq '=>') { 'Added' } else { 'Removed' }
            }
        }
    }

    $delta | Sort-Object GroupName, ChangeType, MemberUPN | Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8
}
catch {
    Write-Error "Group delta report failed: $($_.Exception.Message)"
    throw
}

PowerShellPowerShell KopierenCopy

param(
    [string]$OutputPath = ".\mailbox-size-report.csv"
)

try {
    # Connect to Exchange Online and enumerate user mailboxes
    Import-Module ExchangeOnlineManagement -ErrorAction Stop
    Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop

    $mailboxes = Get-EXOMailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox
    $report = foreach ($mailbox in $mailboxes) {
        $stats = Get-EXOMailboxStatistics -Identity $mailbox.UserPrincipalName -ErrorAction Stop
        [pscustomobject]@{
            DisplayName        = $mailbox.DisplayName
            UserPrincipalName  = $mailbox.UserPrincipalName
            PrimarySmtpAddress = $mailbox.PrimarySmtpAddress
            TotalItemSize      = $stats.TotalItemSize
            ItemCount          = $stats.ItemCount
            LastLogonTime      = $stats.LastLogonTime
            LastUserActionTime = $stats.LastUserActionTime
        }
    }

    $report | Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8
}
catch {
    Write-Error "Mailbox size report failed: $($_.Exception.Message)"
    throw
}
finally {
    Disconnect-ExchangeOnline -Confirm:$false -ErrorAction SilentlyContinue
}

PowerShellPowerShell KopierenCopy

param(
    [string]$OutputPath = ".\teams-ownership-report.csv"
)

try {
    # Connect to Teams and inspect owner/member ratios
    Import-Module MicrosoftTeams -ErrorAction Stop
    Connect-MicrosoftTeams -ErrorAction Stop

    $teams = Get-Team
    $report = foreach ($team in $teams) {
        $users = Get-TeamUser -GroupId $team.GroupId
        [pscustomobject]@{
            DisplayName  = $team.DisplayName
            GroupId      = $team.GroupId
            OwnerCount   = ($users | Where-Object Role -eq 'Owner').Count
            MemberCount  = ($users | Where-Object Role -eq 'Member').Count
            Visibility   = $team.Visibility
            Archived     = $team.Archived
            LastActivity = $team.LastActivityDate
        }
    }

    $report | Sort-Object OwnerCount, MemberCount -Descending | Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8
}
catch {
    Write-Error "Teams ownership report failed: $($_.Exception.Message)"
    throw
}

PowerShellPowerShell KopierenCopy

param(
    [Parameter(Mandatory)]
    [string]$AdminUrl,
    [string]$OutputPath = ".\sharepoint-storage-report.csv"
)

try {
    # Connect to SharePoint Online admin service
    Import-Module Microsoft.Online.SharePoint.PowerShell -ErrorAction Stop
    Connect-SPOService -Url $AdminUrl -ErrorAction Stop

    $sites = Get-SPOSite -Limit All -Detailed
    $report = $sites | Select-Object Url, Title, Owner,
        @{Name='StorageMB';Expression={$_.StorageUsageCurrent}},
        @{Name='StorageQuotaMB';Expression={$_.StorageQuota}},
        @{Name='Template';Expression={$_.Template}},
        @{Name='LastContentModifiedDate';Expression={$_.LastContentModifiedDate}}

    $report | Sort-Object StorageMB -Descending | Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8
}
catch {
    Write-Error "SharePoint storage report failed: $($_.Exception.Message)"
    throw
}

PowerShellPowerShell KopierenCopy

param(
    [string]$OutputPath = ".\conditional-access-gap-analysis.csv"
)

try {
    # Load active member users and enabled CA policies
    Import-Module Microsoft.Graph.Users, Microsoft.Graph.Groups, Microsoft.Graph.Identity.SignIns -ErrorAction Stop
    Connect-MgGraph -Scopes "User.Read.All","Group.Read.All","Policy.Read.All" -NoWelcome -ErrorAction Stop

    $users = Get-MgUser -All -Filter "accountEnabled eq true and userType eq 'Member'" -Property Id,DisplayName,UserPrincipalName
    $policies = Get-MgIdentityConditionalAccessPolicy -All | Where-Object State -ne 'disabled'

    $coveredUserIds = New-Object System.Collections.Generic.HashSet[string]
    foreach ($policy in $policies) {
        foreach ($userId in $policy.Conditions.Users.IncludeUsers) { [void]$coveredUserIds.Add($userId) }
        foreach ($groupId in $policy.Conditions.Users.IncludeGroups) {
            Get-MgGroupMember -GroupId $groupId -All | ForEach-Object { [void]$coveredUserIds.Add($_.Id) }
        }
    }

    $gaps = $users | Where-Object { -not $coveredUserIds.Contains($_.Id) } | Select-Object DisplayName, UserPrincipalName, Id
    $gaps | Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8
}
catch {
    Write-Error "Conditional Access gap analysis failed: $($_.Exception.Message)"
    throw
}
finally {
    Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
}

PowerShellPowerShell KopierenCopy

param(
    [int]$InactiveDays = 90,
    [string]$OutputPath = ".\license-reclamation-report.csv"
)

try {
    # Load user sign-in activity and assigned licenses
    Import-Module Microsoft.Graph.Users -ErrorAction Stop
    Connect-MgGraph -Scopes "User.Read.All","Reports.Read.All" -NoWelcome -ErrorAction Stop

    $cutoff = (Get-Date).AddDays(-$InactiveDays)
    $users = Get-MgUser -All -Property Id,DisplayName,UserPrincipalName,AssignedLicenses,SignInActivity,AccountEnabled

    $report = $users | Where-Object {
        $_.AccountEnabled -and $_.AssignedLicenses.Count -gt 0 -and (
            -not $_.SignInActivity.LastSuccessfulSignInDateTime -or
            ([datetime]$_.SignInActivity.LastSuccessfulSignInDateTime) -lt $cutoff
        )
    } | Select-Object DisplayName, UserPrincipalName,
        @{Name='LicenseCount';Expression={$_.AssignedLicenses.Count}},
        @{Name='LastSuccessfulSignIn';Expression={$_.SignInActivity.LastSuccessfulSignInDateTime}},
        @{Name='DaysInactive';Expression={ if ($_.SignInActivity.LastSuccessfulSignInDateTime) { ((Get-Date) - [datetime]$_.SignInActivity.LastSuccessfulSignInDateTime).Days } else { 9999 } }}

    $report | Sort-Object DaysInactive -Descending | Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8
}
catch {
    Write-Error "License reclamation report failed: $($_.Exception.Message)"
    throw
}
finally {
    Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
}

PowerShellPowerShell KopierenCopy

param(
    [string]$OutputPath = ".\privileged-role-assignments.csv"
)

try {
    # Read active and eligible directory role assignments
    Import-Module Microsoft.Graph.Identity.Governance -ErrorAction Stop
    Connect-MgGraph -Scopes "RoleManagement.Read.All","Directory.Read.All" -NoWelcome -ErrorAction Stop

    $activeAssignments = Get-MgRoleManagementDirectoryRoleAssignmentSchedule -All
    $eligibleAssignments = Get-MgRoleManagementDirectoryRoleEligibilitySchedule -All

    $report = @()
    foreach ($assignment in $activeAssignments) {
        $report += [pscustomobject]@{
            PrincipalId      = $assignment.PrincipalId
            RoleDefinitionId = $assignment.RoleDefinitionId
            AssignmentType   = 'Active'
            StartDateTime    = $assignment.StartDateTime
            EndDateTime      = $assignment.EndDateTime
        }
    }
    foreach ($assignment in $eligibleAssignments) {
        $report += [pscustomobject]@{
            PrincipalId      = $assignment.PrincipalId
            RoleDefinitionId = $assignment.RoleDefinitionId
            AssignmentType   = 'Eligible'
            StartDateTime    = $assignment.StartDateTime
            EndDateTime      = $assignment.EndDateTime
        }
    }

    $report | Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8
}
catch {
    Write-Error "Privileged role report failed: $($_.Exception.Message)"
    throw
}
finally {
    Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
}

PowerShellPowerShell KopierenCopy

param(
    [int]$Days = 30,
    [string]$OutputPath = ".\external-sharing-report.csv"
)

try {
    # Search unified audit log for SharePoint and OneDrive sharing events
    Import-Module ExchangeOnlineManagement -ErrorAction Stop
    Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop

    $startDate = (Get-Date).AddDays(-$Days)
    $operations = 'SharingInvitationCreated','SharingSet','AnonymousLinkCreated','SecureLinkCreated'
    $events = Search-UnifiedAuditLog -StartDate $startDate -EndDate (Get-Date) -Operations $operations -ResultSize 5000

    $report = $events | ForEach-Object {
        $data = $_.AuditData | ConvertFrom-Json
        [pscustomobject]@{
            CreationDate = $_.CreationDate
            Operation    = $_.Operations
            UserId       = $_.UserIds
            SiteUrl      = $data.SiteUrl
            ObjectId     = $data.ObjectId
            TargetUser   = $data.TargetUserOrGroupName
        }
    }

    $report | Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8
}
catch {
    Write-Error "External sharing report failed: $($_.Exception.Message)"
    throw
}
finally {
    Disconnect-ExchangeOnline -Confirm:$false -ErrorAction SilentlyContinue
}

PowerShellPowerShell KopierenCopy

param(
    [string]$OutputPath = ".\mfa-coverage-report.csv"
)

try {
    # Use Graph reporting endpoint for MFA registration status
    Import-Module Microsoft.Graph.Reports -ErrorAction Stop
    Connect-MgGraph -Scopes "Reports.Read.All","Directory.Read.All" -NoWelcome -ErrorAction Stop

    $details = Get-MgReportAuthenticationMethodUserRegistrationDetail -All
    $report = $details | Select-Object UserPrincipalName, UserDisplayName, IsMfaRegistered, IsSsprRegistered,
        @{Name='Methods';Expression={ ($_.MethodsRegistered -join '; ') }},
        @{Name='DefaultMethod';Expression={$_.DefaultMfaMethod}},
        @{Name='IsPasswordlessCapable';Expression={$_.IsPasswordlessCapable}}

    $report | Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8
}
catch {
    Write-Error "MFA coverage report failed: $($_.Exception.Message)"
    throw
}
finally {
    Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
}

PowerShellPowerShell KopierenCopy

param(
    [string]$OutputPath = ".\service-principal-credential-report.csv"
)

try {
    # Enumerate service principal credentials and normalize expiry output
    Import-Module Microsoft.Graph.Applications -ErrorAction Stop
    Connect-MgGraph -Scopes "Application.Read.All" -NoWelcome -ErrorAction Stop

    $servicePrincipals = Get-MgServicePrincipal -All -Property Id,AppId,DisplayName,PasswordCredentials,KeyCredentials
    $report = foreach ($sp in $servicePrincipals) {
        foreach ($secret in $sp.PasswordCredentials) {
            [pscustomobject]@{
                DisplayName   = $sp.DisplayName
                AppId         = $sp.AppId
                CredentialType= 'Secret'
                CredentialName= $secret.DisplayName
                EndDateTime   = $secret.EndDateTime
            }
        }
        foreach ($cert in $sp.KeyCredentials) {
            [pscustomobject]@{
                DisplayName   = $sp.DisplayName
                AppId         = $sp.AppId
                CredentialType= 'Certificate'
                CredentialName= $cert.DisplayName
                EndDateTime   = $cert.EndDateTime
            }
        }
    }

    $report | Sort-Object EndDateTime | Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8
}
catch {
    Write-Error "Service principal credential report failed: $($_.Exception.Message)"
    throw
}
finally {
    Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
}

PowerShellPowerShell KopierenCopy

param(
    [string]$OutputPath = ".\entra-connect-sync-status.csv"
)

try {
    # Run directly on the Entra Connect server
    Import-Module ADSync -ErrorAction Stop

    $scheduler = Get-ADSyncScheduler
    $runHistory = Get-ADSyncRunProfileResult -ConnectorId * -NumberRequested 20

    $report = @(
        [pscustomobject]@{ Metric = 'SyncCycleEnabled'; Value = $scheduler.SyncCycleEnabled },
        [pscustomobject]@{ Metric = 'NextSyncCyclePolicyType'; Value = $scheduler.NextSyncCyclePolicyType },
        [pscustomobject]@{ Metric = 'NextSyncCycleStartTime'; Value = $scheduler.NextSyncCycleStartTimeInUTC },
        [pscustomobject]@{ Metric = 'PurgeRunHistoryInterval'; Value = $scheduler.PurgeRunHistoryInterval },
        [pscustomobject]@{ Metric = 'LastSuccessfulRun'; Value = ($runHistory | Where-Object Result -eq 'success' | Select-Object -First 1).RunEndTime }
    )

    $report | Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8
}
catch {
    Write-Error "Entra Connect sync status failed: $($_.Exception.Message)"
    throw
}

PowerShellPowerShell KopierenCopy

param(
    [string]$OutputPath = ".\compliance-policy-assignments.csv"
)

try {
    # Read Intune compliance policies and their assignments
    Import-Module Microsoft.Graph.DeviceManagement -ErrorAction Stop
    Connect-MgGraph -Scopes "DeviceManagementConfiguration.Read.All","Group.Read.All" -NoWelcome -ErrorAction Stop

    $policies = Get-MgDeviceManagementDeviceCompliancePolicy -All
    $report = foreach ($policy in $policies) {
        foreach ($assignment in $policy.Assignments) {
            [pscustomobject]@{
                PolicyName = $policy.DisplayName
                PolicyId   = $policy.Id
                Assignment = $assignment.Target.AdditionalProperties.'@odata.type'
                GroupId    = $assignment.Target.GroupId
            }
        }
    }

    $report | Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8
}
catch {
    Write-Error "Compliance policy assignment report failed: $($_.Exception.Message)"
    throw
}
finally {
    Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
}

PowerShellPowerShell KopierenCopy

param(
    [string]$OutputPath = ".\defender-o365-config-audit.csv"
)

try {
    # Collect baseline policy state from Exchange Online
    Import-Module ExchangeOnlineManagement -ErrorAction Stop
    Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop

    $report = @()
    Get-SafeLinksPolicy | ForEach-Object {
        $report += [pscustomobject]@{ Workload = 'SafeLinks'; Name = $_.Name; Enabled = $_.EnableSafeLinksForEmail; Detail = "TrackClicks=$($_.TrackClicks)" }
    }
    Get-SafeAttachmentPolicy | ForEach-Object {
        $report += [pscustomobject]@{ Workload = 'SafeAttachments'; Name = $_.Name; Enabled = $true; Detail = "Action=$($_.Action)" }
    }
    Get-AntiPhishPolicy | ForEach-Object {
        $report += [pscustomobject]@{ Workload = 'AntiPhish'; Name = $_.Name; Enabled = $true; Detail = "SpoofIntelligence=$($_.EnableSpoofIntelligence)" }
    }

    $report | Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8
}
catch {
    Write-Error "Defender config audit failed: $($_.Exception.Message)"
    throw
}
finally {
    Disconnect-ExchangeOnline -Confirm:$false -ErrorAction SilentlyContinue
}

PowerShellPowerShell KopierenCopy

param(
    [string]$OutputPath = ".\dns-validation-report.csv"
)

try {
    # Pull accepted domains and resolve key M365 records
    Import-Module ExchangeOnlineManagement -ErrorAction Stop
    Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop

    $domains = Get-AcceptedDomain | Select-Object -ExpandProperty DomainName
    $report = foreach ($domain in $domains) {
        [pscustomobject]@{
            Domain        = $domain
            SPF           = (Resolve-DnsName -Name $domain -Type TXT -ErrorAction SilentlyContinue | Where-Object Strings -match 'v=spf1').Strings -join ' '
            MX            = (Resolve-DnsName -Name $domain -Type MX -ErrorAction SilentlyContinue | Select-Object -ExpandProperty NameExchange -First 1)
            DMARC         = (Resolve-DnsName -Name "_dmarc.$domain" -Type TXT -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Strings -First 1) -join ' '
            DKIMSelector1 = (Resolve-DnsName -Name "selector1._domainkey.$domain" -Type CNAME -ErrorAction SilentlyContinue | Select-Object -ExpandProperty NameHost -First 1)
            Autodiscover  = (Resolve-DnsName -Name "autodiscover.$domain" -Type CNAME -ErrorAction SilentlyContinue | Select-Object -ExpandProperty NameHost -First 1)
        }
    }

    $report | Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8
}
catch {
    Write-Error "DNS validation failed: $($_.Exception.Message)"
    throw
}
finally {
    Disconnect-ExchangeOnline -Confirm:$false -ErrorAction SilentlyContinue
}

PowerShellPowerShell KopierenCopy

param(
    [int]$Days = 30,
    [string]$OutputPath = ".\signin-heatmap-data.csv"
)

try {
    # Summarize sign-ins by weekday and hour
    Import-Module Microsoft.Graph.Identity.SignIns -ErrorAction Stop
    Connect-MgGraph -Scopes "AuditLog.Read.All" -NoWelcome -ErrorAction Stop

    $since = (Get-Date).AddDays(-$Days).ToUniversalTime().ToString('s') + 'Z'
    $signIns = Get-MgAuditLogSignIn -All -Filter "createdDateTime ge $since"

    $heatmap = $signIns | Group-Object { "{0}-{1}" -f $_.CreatedDateTime.DayOfWeek, $_.CreatedDateTime.Hour } | ForEach-Object {
        $parts = $_.Name.Split('-')
        [pscustomobject]@{
            Weekday     = $parts[0]
            Hour        = [int]$parts[1]
            SignInCount = $_.Count
        }
    }

    $heatmap | Sort-Object Weekday, Hour | Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8
}
catch {
    Write-Error "Sign-in heatmap export failed: $($_.Exception.Message)"
    throw
}
finally {
    Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
}

PowerShellPowerShell KopierenCopy

param(
    [Parameter(Mandatory)]
    [string]$InputCsv,
    [string]$OutputPath = ".\bulk-password-reset-results.csv"
)

try {
    # Reset password and create a Temporary Access Pass per user
    Import-Module Microsoft.Graph.Users -ErrorAction Stop
    Connect-MgGraph -Scopes "User.ReadWrite.All","UserAuthenticationMethod.ReadWrite.All" -NoWelcome -ErrorAction Stop

    $users = Import-Csv $InputCsv -ErrorAction Stop
    $report = foreach ($user in $users) {
        Update-MgUser -UserId $user.UserPrincipalName -PasswordProfile @{ ForceChangePasswordNextSignIn = $true; Password = $user.NewPassword } -ErrorAction Stop
        $tap = New-MgUserAuthenticationTemporaryAccessPassMethod -UserId $user.UserPrincipalName -BodyParameter @{ isUsableOnce = $true; lifetimeInMinutes = 60 } -ErrorAction Stop

        [pscustomobject]@{
            UserPrincipalName     = $user.UserPrincipalName
            PasswordReset         = $true
            TemporaryAccessPass   = $tap.TemporaryAccessPass
            TemporaryAccessPassId = $tap.Id
        }
    }

    $report | Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8
}
catch {
    Write-Error "Bulk password reset failed: $($_.Exception.Message)"
    throw
}
finally {
    Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
}

PowerShellPowerShell KopierenCopy

param(
    [string]$CsvOutputPath = ".\tenant-security-posture-summary.csv",
    [string]$JsonOutputPath = ".\tenant-security-posture-details.json"
)

try {
    # Gather security posture metrics from multiple Graph workloads
    Import-Module Microsoft.Graph.Users, Microsoft.Graph.Reports, Microsoft.Graph.Identity.SignIns, Microsoft.Graph.Identity.Governance -ErrorAction Stop
    Connect-MgGraph -Scopes "User.Read.All","Reports.Read.All","AuditLog.Read.All","Policy.Read.All","RoleManagement.Read.All" -NoWelcome -ErrorAction Stop

    $users = Get-MgUser -All -Property Id,UserType,AccountEnabled,SignInActivity
    $mfa = Get-MgReportAuthenticationMethodUserRegistrationDetail -All
    $caPolicies = Get-MgIdentityConditionalAccessPolicy -All
    $activeRoles = Get-MgRoleManagementDirectoryRoleAssignmentSchedule -All

    $summary = @(
        [pscustomobject]@{ Metric = 'TotalUsers'; Value = $users.Count },
        [pscustomobject]@{ Metric = 'Guests'; Value = ($users | Where-Object UserType -eq 'Guest').Count },
        [pscustomobject]@{ Metric = 'Inactive90Days'; Value = ($users | Where-Object { $_.SignInActivity.LastSuccessfulSignInDateTime -and ([datetime]$_.SignInActivity.LastSuccessfulSignInDateTime) -lt (Get-Date).AddDays(-90) }).Count },
        [pscustomobject]@{ Metric = 'MfaRegistered'; Value = ($mfa | Where-Object IsMfaRegistered).Count },
        [pscustomobject]@{ Metric = 'ConditionalAccessPolicies'; Value = $caPolicies.Count },
        [pscustomobject]@{ Metric = 'PrivilegedAssignments'; Value = $activeRoles.Count }
    )

    $summary | Export-Csv $CsvOutputPath -NoTypeInformation -Encoding UTF8

    $details = [pscustomobject]@{
        GeneratedAt = Get-Date
        Summary     = $summary
        Policies    = $caPolicies | Select-Object DisplayName, State, CreatedDateTime, ModifiedDateTime
    }
    $details | ConvertTo-Json -Depth 10 | Set-Content -Path $JsonOutputPath -Encoding UTF8
}
catch {
    Write-Error "Tenant security posture report failed: $($_.Exception.Message)"
    throw
}
finally {
    Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
}