Skip to main content

​
SYNOPSIS

Summarizes how every user of a Microsoft Entra ID tenant authenticates, internal and external alike.

​
SYNTAX

​
DESCRIPTION

Returns one row per distinct combination of (SignInType, Issuer, UserType, CreationType, InvitationState, IsExternal) with the number of identities matching it. It gives a one-page picture of the authentication landscape of the tenant. The granularity is the identity, not the user. A cloud-only internal user carries a single identity (‘userPrincipalName’ issued by this tenant). An external account that redeemed its invitation carries two: the local ‘userPrincipalName’ one plus a ‘federated’ one issued by its identity provider. An account that never redeemed its invitation only carries the local one, which is exactly what this view makes visible. Because internal and external accounts can share the very same (SignInType, Issuer) pair, the IsExternal column tells them apart. It uses the same detection as Get-MgExternalUser, so both reports always agree.

​
EXAMPLES

​
EXAMPLE 1

Displays the identity summary of the whole tenant as a table. Format-Table is needed because the objects carry more than four properties, which PowerShell would otherwise render as a list.

​
EXAMPLE 2

Same summary restricted to the external accounts.

​
EXAMPLE 3

Same summary with the real domains masked, suitable for sharing outside of the organization.

​
EXAMPLE 4

Exports the identity summary to an Excel file in the user’s profile directory.

​
PARAMETERS

​
-ExternalOnly

(Optional) Restricts the summary to external accounts. Without it, every user of the tenant is included, which is the point of this function.

​
-Anonymize

(Optional) Replaces the real issuer domains with placeholders: <OUR-TENANT-DOMAIN> for a domain belonging to this tenant, <OTHER-DOMAIN> for any third-party domain. Well-known issuers (ExternalAzureAD, MSA, mail, google.com, …) are kept as-is. Use it to share the summary outside of the organization. Requires the Domain.Read.All permission to know which domains belong to this tenant.

​
-ForceNewToken

Switch parameter to force getting a new token from Microsoft Graph.

​
-ExportToExcel

(Optional) If specified, exports the results to an Excel file in the user’s profile directory.

​
-ExportPath

(Optional) Output directory for the Excel export. Defaults to the user profile.

​
CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

​
INPUTS

​
OUTPUTS

​
System.Collections.Generic.List[PSCustomObject]

​
NOTES

OUTPUT PROPERTIES
  • Count : number of identities matching the combination
  • SignInType : signInType of the identity (‘userPrincipalName’, ‘federated’, …) ‘<no identities>’ when Graph returned no identity at all for the account
  • Issuer : issuer of the identity (a tenant domain, ExternalAzureAD, MSA, mail, …)
  • UserType : userType of the account holding the identity (Member or Guest)
  • CreationType : creationType of the account (‘Invitation’ when it comes from a B2B invitation)
  • InvitationState : Graph ‘externalUserState’ property (PendingAcceptance, Accepted, or empty)
  • IsExternal : whether the account holding the identity is external (see Get-MgExternalUser)
Required Microsoft Graph permissions:
  • User.Read.All
  • Domain.Read.All (only with -Anonymize)
https://ps365.clidsys.com/docs/commands/Get-MgUserIdentitySummary