# Compare-UserAttribute Source: https://ps365.clidsys.com/docs/commands/Compare-UserAttribute Compare two user attributes from different sources. # Compare-UserAttribute ## SYNOPSIS Compare two user attributes from different sources. ## SYNTAX ```powershell theme={null} Compare-UserAttribute [-Attribute1] [-Attribute2] [-Source] [[-User] ] [[-ByDomain] ] [-Return] ``` ## DESCRIPTION This function compares two specified user attributes from Active Directory, Entra ID (Microsoft Graph), or Exchange. It can filter users based on email domain or specific user identities and returns users whose attributes either match or do not match. PowerShell 7 and Active Directory: PS365 requires PowerShell 7 or later. Source AD can still be used on Windows with the ActiveDirectory module supplied by compatible RSAT tools. Calling Get-ADUser does not inherently require PowerShell 5.1. For example, Microsoft lists the ActiveDirectory module on Windows Server 2019 with RSAT-AD-PowerShell as natively compatible with PowerShell 7. Import-Module ActiveDirectory -ErrorAction Stop loads it. If your installed AD module needs Windows PowerShell compatibility, run Import-Module ActiveDirectory -UseWindowsPowerShell -ErrorAction Stop from PowerShell 7 on Windows. This runs the module in a background Windows PowerShell 5.1 session and returns deserialized objects. Simple property comparisons generally work, but live AD object methods are not preserved. This does not provide ActiveDirectory support on Linux or macOS. Only Source AD needs this module, domain connectivity and appropriate AD read permissions. Source EntraID and Source Exchange do not depend on ActiveDirectory. The function does not install RSAT or explicitly select a compatibility mode; prepare the required module/session before calling it. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Import-Module ActiveDirectory -ErrorAction Stop Compare-UserAttribute -Source AD -Attribute1 mail -Attribute2 UserPrincipalName -Return NotMatching ``` From PowerShell 7 on Windows with compatible RSAT tools, compares the 'mail' and 'UserPrincipalName' attributes in Active Directory and returns users whose values differ. ### EXAMPLE 2 ```powershell theme={null} Compare-UserAttribute -Attribute1 "userPrincipalName" -Attribute2 "mail" -Source "EntraID" -Return "NotMatching" ``` Compares the 'userPrincipalName' and 'mail' attributes for users in Entra ID and returns those with non-matching values. ## PARAMETERS ### -Attribute1 The first user attribute to compare. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Attribute2 The second user attribute to compare. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 1 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ByDomain An array of email domains to filter users. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 4 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Return Specifies whether to return users with 'Matching' or 'NotMatching' attributes. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 5 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Source The source from which to retrieve user information. Valid options are 'AD' for Active Directory, 'EntraID' for Microsoft Entra ID, and 'Exchange' for Exchange. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 2 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -User An array of user identities to filter the comparison. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 3 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Compare-UserAttribute](https://ps365.clidsys.com/docs/commands/Compare-UserAttribute) * [https://learn.microsoft.com/en-us/powershell/windows/module-compatibility?view=windowsserver2019-ps](https://learn.microsoft.com/en-us/powershell/windows/module-compatibility?view=windowsserver2019-ps) * [https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about\_windows\_powershell\_compatibility](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_windows_powershell_compatibility) # Convert-EntraObjectIDAndSID Source: https://ps365.clidsys.com/docs/commands/Convert-EntraObjectIDAndSID Converts between Microsoft Entra ID SID and Object ID formats. # Convert-EntraObjectIDAndSID ## SYNOPSIS Converts between Microsoft Entra ID SID and Object ID formats. ## SYNTAX ```powershell theme={null} Convert-EntraObjectIDAndSID [-Value] ``` ## DESCRIPTION Automatically detects whether the input is a SID (S-1-12-1-...) or an Object ID (GUID) and converts it to the other format. * SID (S-1-12-1-...) → returns the corresponding Object ID (GUID) * Object ID (GUID) → returns the corresponding SID (S-1-12-1-...) ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Convert-EntraObjectIDAndSID -Value "S-1-12-1-1234567890-987654321-1122334455-5544332211" ``` Converts the given SID to its corresponding Object ID (GUID). ### EXAMPLE 2 ```powershell theme={null} Convert-EntraObjectIDAndSID -Value "a1b2c3d4-e5f6-7890-abcd-ef1234567890" ``` Converts the given Object ID to its corresponding SID. ### EXAMPLE 3 ```powershell theme={null} "S-1-12-1-1234567890-987654321-1122334455-5544332211", "a1b2c3d4-e5f6-7890-abcd-ef1234567890" | Convert-EntraObjectIDAndSID ``` Converts multiple values via pipeline input. ## PARAMETERS ### -Value The SID or Object ID to convert. Accepts pipeline input. * SID format: S-1-12-1-`{4 decimal numbers separated by dashes}` * Object ID format: GUID (e.g., xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx) ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: true ValueFromPipeline: true ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String *Not documented.* ## OUTPUTS ## NOTES Entra ID uses a specific SID format: S-1-12-1-`{4 UInt32 components derived from the GUID bytes}`. This conversion is bijective: SID \<-> ObjectID. ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Convert-EntraObjectIDAndSID](https://ps365.clidsys.com/docs/commands/Convert-EntraObjectIDAndSID) # Copy-AzAutomationRunbook Source: https://ps365.clidsys.com/docs/commands/Copy-AzAutomationRunbook Copies all runbooks from a source Azure Automation account to a destination account. # Copy-AzAutomationRunbook ## SYNOPSIS Copies all runbooks from a source Azure Automation account to a destination account. ## SYNTAX ```powershell theme={null} Copy-AzAutomationRunbook [-SourceAutomationAccount] [-DestinationAutomationAccount] [-ResourceGroup] [[-TempFolder] ] ``` ## DESCRIPTION This function exports all runbooks from a source Azure Automation account and imports them into a destination Azure Automation account within the same resource group. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Copy-AzAutomationRunbook -SourceAutomationAccount 'newauto' -DestinationAutomationAccount 'newauto1' -ResourceGroup 'my-rg' ``` Copies all runbooks from 'newauto' to 'newauto1'. ### EXAMPLE 2 ```powershell theme={null} Copy-AzAutomationRunbook -SourceAutomationAccount 'newauto' -DestinationAutomationAccount 'newauto1' -ResourceGroup 'my-rg' -TempFolder 'C:\Temp\Runbooks' ``` Copies all runbooks using a custom temporary folder. ## PARAMETERS ### -DestinationAutomationAccount The name of the destination Azure Automation account to import runbooks into. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 1 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ResourceGroup The name of the resource group containing both Automation accounts. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 2 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -SourceAutomationAccount The name of the source Azure Automation account to export runbooks from. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -TempFolder (Optional) The temporary folder path used to store exported runbooks. Defaults to a timestamped folder in the system temp directory. Note: Only auto-generated folders are deleted at the end. If you provide an existing folder, its contents are NOT cleaned up. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 3 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Copy-AzAutomationRunbook](https://ps365.clidsys.com/docs/commands/Copy-AzAutomationRunbook) # Disable-MSSelfServicePurchase Source: https://ps365.clidsys.com/docs/commands/Disable-MSSelfServicePurchase Disables self-service purchase for ALL products in Microsoft 365. # Disable-MSSelfServicePurchase ## SYNOPSIS Disables self-service purchase for ALL products in Microsoft 365. ## SYNTAX ```powershell theme={null} Disable-MSSelfServicePurchase [-Force] [-WhatIf] [-Confirm] ``` ## DESCRIPTION This function connects to the Microsoft Commerce service and disables the self-service purchase option for all products that currently have it enabled. This is useful for organizations that want to prevent users from purchasing additional services or products on their own. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Disable-MSSelfServicePurchase ``` Disables self-service purchase for all products in the Microsoft 365 tenant, prompting for confirmation for each product. ### EXAMPLE 2 ```powershell theme={null} Disable-MSSelfServicePurchase -Force ``` Disables self-service purchase for all products without prompting for confirmation. ## PARAMETERS ### -Confirm Prompts you for confirmation before running the cmdlet. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - cf ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Force Skips confirmation prompts and disables self-service purchase for all products without asking. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -WhatIf Runs the command in a mode that only reports what would happen without performing the actions. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - wi ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Disable-MSSelfServicePurchase](https://ps365.clidsys.com/docs/commands/Disable-MSSelfServicePurchase) # Enable-MSSelfServicePurchase Source: https://ps365.clidsys.com/docs/commands/Enable-MSSelfServicePurchase Enables self-service purchase for all products in Microsoft 365. # Enable-MSSelfServicePurchase ## SYNOPSIS Enables self-service purchase for all products in Microsoft 365. ## SYNTAX ```powershell theme={null} Enable-MSSelfServicePurchase [-Force] [-WhatIf] [-Confirm] ``` ## DESCRIPTION This function connects to the Microsoft Commerce service and enables the self-service purchase option for all products that currently have it disabled. This is useful for organizations that want to allow users to purchase additional services or products on their own. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Enable-MSSelfServicePurchase ``` Enables self-service purchase for all products in the Microsoft 365 tenant, prompting for confirmation for each product. ### EXAMPLE 2 ```powershell theme={null} Enable-MSSelfServicePurchase -Force ``` Enables self-service purchase for all products without prompting for confirmation. ## PARAMETERS ### -Confirm Prompts you for confirmation before running the cmdlet. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - cf ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Force Skips confirmation prompts and enables self-service purchase for all products without asking. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -WhatIf Runs the command in a mode that only reports what would happen without performing the actions. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - wi ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Enable-MSSelfServicePurchase](https://ps365.clidsys.com/docs/commands/Enable-MSSelfServicePurchase) # Find-DistributionGroupMember Source: https://ps365.clidsys.com/docs/commands/Find-DistributionGroupMember Find members of distribution groups based on email address or domain. # Find-DistributionGroupMember ## SYNOPSIS Find members of distribution groups based on email address or domain. ## SYNTAX ```powershell theme={null} Find-DistributionGroupMember [[-FilterByDomain] ] [[-FilterByEmailAddresses] ] [[-FilterRecipientTypeDetails] ] [-FilterByExternalDomains] ``` ## DESCRIPTION This function retrieves members of all distribution groups in Exchange Online that match specified criteria such as email addresses or domains. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Find-DistributionGroupMember -FilterByDomain "contoso.com" ``` Searches all distribution groups for members with email addresses containing "contoso.com" and exports the results to a CSV file. ### EXAMPLE 2 ```powershell theme={null} Find-DistributionGroupMember -FilterByEmailAddresses "user@contoso.com" ``` Searches all distribution groups for members with the email address "[user@contoso.com](mailto:user@contoso.com)" and exports the results to a CSV file. ### EXAMPLE 3 ```powershell theme={null} Find-DistributionGroupMember -FilterByExternalDomains -FilterRecipientTypeDetails "MailContact" ``` Searches all distribution groups for members whose email addresses belong to external domains and are of the type "MailContact", then exports the results to a CSV file. ## PARAMETERS ### -FilterByDomain Specify a domain to filter distribution group members by their email addresses. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -FilterByEmailAddresses Provide specific email addresses to filter distribution group members. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 1 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -FilterByExternalDomains If set to true, filters members whose email addresses belong to external domains not managed in the Exchange Online environment (based on accepted domains). ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -FilterRecipientTypeDetails Specify a recipient type detail to further filter the members (e.g., MailContact, MailUser). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 2 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Find-DistributionGroupMember](https://ps365.clidsys.com/docs/commands/Find-DistributionGroupMember) # Find-M365Email Source: https://ps365.clidsys.com/docs/commands/Find-M365Email Find email addresses across various services. # Find-M365Email ## SYNOPSIS Find email addresses across various services. ## SYNTAX ```powershell theme={null} Find-M365Email [[-SearchEmail] ] [[-ByDomain] ] ``` ## DESCRIPTION This function searches for email addresses across Exchange Online recipients, Microsoft 365 users, and deleted users. It can filter results by specific email addresses or by domain. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Find-M365Email -SearchEmail "user@example.com" ``` Searches for the specified email address and displays its details if found. ### EXAMPLE 2 ```powershell theme={null} Find-M365Email -ByDomain "example.com" ``` Searches for all email addresses within the specified domain and displays their details. ## PARAMETERS ### -ByDomain An array of domains to search for. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 1 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -SearchEmail An array of email addresses to search for. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Find-M365Email](https://ps365.clidsys.com/docs/commands/Find-M365Email) # Get-DynamicGroup Source: https://ps365.clidsys.com/docs/commands/Get-DynamicGroup Retrieves dynamic groups from Microsoft 365, Exchange Online, and Entra ID with attribute analysis. # Get-DynamicGroup ## SYNOPSIS Retrieves dynamic groups from Microsoft 365, Exchange Online, and Entra ID with attribute analysis. ## SYNTAX ```powershell theme={null} Get-DynamicGroup [[-GroupId] ] [-ExchangeOnlineOnly] [-EntraIDOnly] [-ExportToExcel] [-ExportPath ] [-IncludeMembers] [-MemberReport] [-DeprecatedMemberOfRuleOnly] ``` ## DESCRIPTION The Get-DynamicGroup function retrieves all dynamic groups from Microsoft 365 environments, including Exchange Online Dynamic Distribution Groups and Entra ID Dynamic Security/M365 Groups. It analyzes membership rules to extract attributes and provides security warnings for attributes in the "Personal-Information" property set that users can modify themselves. By default, only the member count is returned (MembersCount). Use -IncludeMembers to also get the concatenated lists of member names and IDs, or -MemberReport to get one row per (group, member). ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-DynamicGroup ``` Retrieves all dynamic groups from both Exchange Online and Entra ID (members count only). ### EXAMPLE 2 ```powershell theme={null} Get-DynamicGroup -ExchangeOnlineOnly ``` Retrieves only Exchange Online Dynamic Distribution Groups. ### EXAMPLE 3 ```powershell theme={null} Get-DynamicGroup -EntraIDOnly ``` Retrieves only Entra ID Dynamic Groups. ### EXAMPLE 4 ```powershell theme={null} Get-DynamicGroup -IncludeMembers ``` Retrieves all dynamic groups with MembersName and MembersId populated (pipe-separated). ### EXAMPLE 5 ```powershell theme={null} Get-DynamicGroup -MemberReport ``` Returns one row per (group, member). Each row contains the group context and a single member. ### EXAMPLE 6 ```powershell theme={null} Get-DynamicGroup -MemberReport -ExportToExcel ``` Exports both the per-group sheet ("DynamicGroups") and the per-member sheet ("Members") in the same Excel workbook. ### EXAMPLE 7 ```powershell theme={null} Get-DynamicGroup -DeprecatedMemberOfRuleOnly ``` Returns only the dynamic groups using the deprecated MemberOf rule operator, whose memberships stop updating after November 3, 2026. ### EXAMPLE 8 ```powershell theme={null} Get-DynamicGroup -DeprecatedMemberOfRuleOnly -ExportToExcel ``` Exports the groups using the deprecated MemberOf rule operator to an Excel file. ## PARAMETERS ### -DeprecatedMemberOfRuleOnly When specified, returns only the groups whose membership rule uses the deprecated MemberOf rule operator (e.g. user.memberof -any (group.objectId -in \[...])). Microsoft ends this preview operator: after November 3, 2026, affected memberships stop updating and stay in their last known state. This operator only exists in Entra ID membership rules, so this switch implies Entra ID only (Exchange Online is skipped, no need to add -EntraIDOnly). Without this switch, the DeprecatedMemberOfRule property still flags affected groups. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -EntraIDOnly When specified, retrieves only Entra ID Dynamic Groups (Security and M365 groups). Requires an active Microsoft Graph connection (use Connect-MgGraph). ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExchangeOnlineOnly When specified, retrieves only Exchange Online Dynamic Distribution Groups. Requires an active Exchange Online session (use Connect-ExchangeOnline). ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel When specified, exports the result to an Excel file in the user's profile directory instead of returning it. When combined with -MemberReport, the member rows are written to a second worksheet named "Members" in the same workbook. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -GroupId When specified, retrieves dynamic groups by their unique GroupId. If not specified, retrieves all dynamic groups (both Exchange Online and Entra ID). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IncludeMembers When specified, populates the MembersName (pipe-separated display names) and MembersId (pipe-separated object IDs) properties in addition to MembersCount. By default, only MembersCount is populated to avoid slow enumeration on large groups. Ignored when -MemberReport is used. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -MemberReport When specified, the function returns one row per (group, member) pair instead of the per-group aggregated objects. Useful to export a flat list of members with their parent group. Output columns: GroupId, GroupName, GroupType, MembershipRule, MemberId, MemberDisplayName, MemberPrincipal, MemberType. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ### System.Collections.Generic.List\[Object] *Not documented.* ## NOTES OUTPUT PROPERTIES (default / -IncludeMembers mode) Returns a collection of custom objects with the following properties: * GroupId: Unique identifier of the group * Name: Display name of the group * Type: Type of dynamic group (Exchange Dynamic Distribution Group, M365 Dynamic Group, Entra ID Dynamic Security Group) * MembershipRule: The membership rule or LDAP filter used for dynamic membership * MembershipRuleProcessingState: Processing state of the membership rule (Entra ID only) * UserAttributes: Pipe-separated list of user attributes referenced in the membership rule * GroupAttributes: Pipe-separated list of group attributes referenced in the membership rule (Entra ID only) * DeviceAttributes: Pipe-separated list of device attributes referenced in the membership rule (Entra ID only) * MemberOf: Pipe-separated list of parent groups * MembersCount: Number of current members of the group * MembersName: Pipe-separated list of member display names (only with -IncludeMembers) * MembersId: Pipe-separated list of member IDs (only with -IncludeMembers) * DisplayName, Description, Mail, MailEnabled, MailNickname, SecurityEnabled, GroupTypes, CreatedDateTime, RenewedDateTime, OnPremisesSyncEnabled, SecurityIdentifier, Classification, Visibility * DeprecatedMemberOfRule: True if the membership rule uses the deprecated MemberOf rule operator (preview ending: memberships stop updating after November 3, 2026) * Warning: Security warning if any attribute is in the "Personal-Information" property set, and/or deprecation warning if the group uses the MemberOf rule operator OUTPUT PROPERTIES (-MemberReport mode) * GroupId, GroupName, GroupType, MembershipRule * MemberId, MemberDisplayName, MemberPrincipal, MemberType Security Considerations: This function identifies attributes in the "Personal-Information" property set that users can modify themselves, potentially allowing unauthorized group membership. Review warnings carefully. More information on: [https://itpro-tips.com/property-set-personal-information-and-active-directory-security-and-governance/](https://itpro-tips.com/property-set-personal-information-and-active-directory-security-and-governance/) ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-DynamicGroup](https://ps365.clidsys.com/docs/commands/Get-DynamicGroup) # Get-EmptyGroup Source: https://ps365.clidsys.com/docs/commands/Get-EmptyGroup Retrieves all empty groups (zero members) in Microsoft Entra ID. # Get-EmptyGroup ## SYNOPSIS Retrieves all empty groups (zero members) in Microsoft Entra ID. ## SYNTAX ```powershell theme={null} Get-EmptyGroup [[-ExportPath] ] [-ExportToExcel] ``` ## DESCRIPTION The Get-EmptyGroup function retrieves all groups from Microsoft Entra ID via the Microsoft Graph API and identifies those with no members. It supports optional export to Excel or CSV for further analysis and cleanup. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-EmptyGroup ``` Retrieves all empty groups and outputs them to the console. ### EXAMPLE 2 ```powershell theme={null} Get-EmptyGroup -ExportToExcel ``` Retrieves all empty groups and exports the results to an Excel file. ### EXAMPLE 3 ```powershell theme={null} Get-EmptyGroup -ExportCsv 'C:\temp\empty-groups.csv' ``` Retrieves all empty groups and exports the results to a CSV file. ## PARAMETERS ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel When specified, exports the results to an Excel file in the user's profile directory. Requires the ImportExcel module. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ### System.Collections.Generic.List\[Object] *Not documented.* ## NOTES OUTPUT PROPERTIES Returns a collection of custom objects with the following properties: * DisplayName: Display name of the group * ObjectId: Unique identifier of the group * Type: Type of group (Microsoft 365, Dynamic, Mail-enabled Security, Security, Distribution, Other) * Mail: Primary email address of the group * Created: Creation date of the group (yyyy-MM-dd) * Description: Description of the group Requires Microsoft.Graph module: Connect-MgGraph -Scopes 'Group.Read.All' ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-EmptyGroup](https://ps365.clidsys.com/docs/commands/Get-EmptyGroup) # Get-EntraIDHybridJoinComputerInfo Source: https://ps365.clidsys.com/docs/commands/Get-EntraIDHybridJoinComputerInfo Retrieves detailed information about Entra ID Hybrid Join configuration on the local computer. # Get-EntraIDHybridJoinComputerInfo ## SYNOPSIS Retrieves detailed information about Entra ID Hybrid Join configuration on the local computer. ## SYNTAX ```powershell theme={null} Get-EntraIDHybridJoinComputerInfo [[-ExportPath] ] [-ExportToExcel] ``` ## DESCRIPTION This function gathers comprehensive diagnostics for Entra ID Hybrid Join status including: * Service Connection Point (SCP) details * Network connectivity to Microsoft Entra ID endpoints * Registry keys related to hybrid join * Scheduled tasks for Automatic Device Join * Computer certificates in AD and local store * Event logs for device registration * dsregcmd status output ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-EntraIDHybridJoinComputerInfo ``` Retrieves all hybrid join diagnostic information for the local computer. ### EXAMPLE 2 ```powershell theme={null} Get-EntraIDHybridJoinComputerInfo -ExportToExcel "C:\Reports\HybridJoinInfo.xlsx" ``` Retrieves hybrid join information and exports it to an Excel file. ## PARAMETERS ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel Optional path to export the results to an Excel file. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES Must be run on a domain-joined computer. ## RELATED LINKS *Not documented.* # Get-EntraIDHybridJoinComputerRegistryKey Source: https://ps365.clidsys.com/docs/commands/Get-EntraIDHybridJoinComputerRegistryKey Retrieves Entra ID Hybrid Join registry keys from the local computer. # Get-EntraIDHybridJoinComputerRegistryKey ## SYNOPSIS Retrieves Entra ID Hybrid Join registry keys from the local computer. ## SYNTAX ```powershell theme={null} Get-EntraIDHybridJoinComputerRegistryKey ``` ## DESCRIPTION This function reads registry keys from HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CDJ\AAD to retrieve TenantId, TenantName, and other hybrid join configuration values. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-EntraIDHybridJoinComputerRegistryKey ``` Returns an object containing TenantId, TenantName, and other registry keys if present. ## PARAMETERS ## INPUTS ## OUTPUTS ## NOTES Returns a PSCustomObject with ComputerName, TenantId, TenantName, and OtherKeys properties. Properties will be null if the registry path or values do not exist. ## RELATED LINKS *Not documented.* # Get-EntraIDHybridJoinSCP Source: https://ps365.clidsys.com/docs/commands/Get-EntraIDHybridJoinSCP Retrieves the Service Connection Point (SCP) for Entra ID Hybrid Join from Active Directory. # Get-EntraIDHybridJoinSCP ## SYNOPSIS Retrieves the Service Connection Point (SCP) for Entra ID Hybrid Join from Active Directory. ## SYNTAX ```powershell theme={null} Get-EntraIDHybridJoinSCP ``` ## DESCRIPTION This function queries the Active Directory configuration naming context to retrieve the Service Connection Point (SCP) object for device registration, which contains Microsoft Entra ID tenant information. If Active Directory is not accessible, it returns an object with error information and null values for the SCP data. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-EntraIDHybridJoinSCP ``` Returns the SCP object with keywords containing AzureADName and azureADId when AD is accessible. ### EXAMPLE 2 ```powershell theme={null} $result = Get-EntraIDHybridJoinSCP if (-not $result.ADAccessible) { Write-Warning "Cannot access Active Directory: $($result.ErrorMessage)" } ``` Tests if Active Directory is accessible and handles the error case. ## PARAMETERS ## INPUTS ## OUTPUTS ## NOTES Requires access to Active Directory and the configuration naming context. Must be run on a domain-joined computer or with appropriate AD access. The returned object includes: * WhenCreated: Creation date of the SCP object * WhenChanged: Last modification date of the SCP object * Keywords: Pipe-separated keywords containing AzureADName and azureADId * Path: LDAP path to the SCP object * ErrorMessage: Error details if AD is not accessible (null if successful) * ADAccessible: Boolean indicating if AD was accessible ## RELATED LINKS *Not documented.* # Get-EntraIDRegcmd Source: https://ps365.clidsys.com/docs/commands/Get-EntraIDRegcmd Retrieves the current device registration status by invoking the 'dsregcmd /status' command and parsing its output. # Get-EntraIDRegcmd ## SYNOPSIS Retrieves the current device registration status by invoking the 'dsregcmd /status' command and parsing its output. ## SYNTAX ```powershell theme={null} Get-EntraIDRegcmd ``` ## DESCRIPTION Retrieves the current device registration status by invoking the 'dsregcmd /status' command and parsing its output. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-EntraIDRegcmd ``` ## PARAMETERS ## INPUTS ## OUTPUTS ## NOTES ## RELATED LINKS *Not documented.* # Get-ExMailboxByDomain Source: https://ps365.clidsys.com/docs/commands/Get-ExMailboxByDomain Retrieves all Exchange mailboxes for a specified domain. # Get-ExMailboxByDomain ## SYNOPSIS Retrieves all Exchange mailboxes for a specified domain. ## SYNTAX ```powershell theme={null} Get-ExMailboxByDomain [[-Domain] ] [-RecipientTypeDetails ] [-ExportToExcel] ``` ## DESCRIPTION This function retrieves all Exchange mailboxes that belong to a specified domain. It filters the mailboxes based on their *primarySMTP* address to ensure they match the provided domain. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-ExMailboxByDomain -Domain "example.com" ``` Returns all Exchange mailboxes associated with the domain "example.com". ## PARAMETERS ### -Domain The domain for which to retrieve the mailboxes. This should be a string representing the domain (e.g., "example.com"). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: true ValueFromPipelineByPropertyName: true ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel If specified, exports the retrieved mailbox information to an Excel file in the user's profile directory. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -RecipientTypeDetails Filters the mailboxes by their recipient type details. Acceptable values include: * UserMailbox * SharedMailbox * RoomMailbox * EquipmentMailbox * LinkedMailbox * SchedulingMailbox ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String *Not documented.* ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-ExMailboxByDomain](https://ps365.clidsys.com/docs/commands/Get-ExMailboxByDomain) # Get-ExMailboxForwarding Source: https://ps365.clidsys.com/docs/commands/Get-ExMailboxForwarding Get mailbox forwarding configuration # Get-ExMailboxForwarding ## SYNOPSIS Get mailbox forwarding configuration ## SYNTAX ```powershell theme={null} Get-ExMailboxForwarding [[-Identity] ] [-ForwardingAndForwardingSMTPOnly] [-InboxRulesOnly] [-ExportToExcel] [-ExportPath ] [-ExchangeOnPremise] ``` ## DESCRIPTION Get mailbox forwarding configuration from ForwardingAddress, ForwardingSMTPAddress and Inbox Rules ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-ExMailboxForwarding ``` Returns all mailboxes with forwarding configuration. ### EXAMPLE 2 ```powershell theme={null} Get-ExMailboxForwarding -Mailboxes "user1@example.com","user2@example.com" ``` Returns forwarding configuration for specified mailboxes. ### EXAMPLE 3 ```powershell theme={null} Get-ExMailboxForwarding -ForwardingAndForwardingSMTPOnly ``` Returns only mailboxes with ForwardingAddress or ForwardingSMTPAddress set. ### EXAMPLE 4 ```powershell theme={null} Get-ExMailboxForwarding -InboxRulesOnly ``` Returns only mailboxes with inbox rules that forward emails. ### EXAMPLE 5 ```powershell theme={null} Get-ExMailboxForwarding -ExportToExcel ``` Exports results to an Excel file. ## PARAMETERS ### -ExchangeOnPremise *Not documented.* ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel If specified, exports the results to an Excel file in the user's profile directory. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ForwardingAndForwardingSMTPOnly *Not documented.* ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Identity *Not documented.* ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: true ValueFromPipelineByPropertyName: true ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -InboxRulesOnly *Not documented.* ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String\[] *Not documented.* ## OUTPUTS ## NOTES Priority 1: ForwardingAddress Priority 2: ForwardingSMTPAddress Priority 3: Inbox Rules ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-ExMailboxForwarding](https://ps365.clidsys.com/docs/commands/Get-ExMailboxForwarding) # Get-ExMailboxFromAttribute Source: https://ps365.clidsys.com/docs/commands/Get-ExMailboxFromAttribute Get mailboxes based on a custom attribute and compare specified attributes. # Get-ExMailboxFromAttribute ## SYNOPSIS Get mailboxes based on a custom attribute and compare specified attributes. ## SYNTAX ```powershell theme={null} Get-ExMailboxFromAttribute [[-Attribute] ] [-CheckAttributes ] [-ExportToExcel] [-ExportPath ] ``` ## DESCRIPTION This function retrieves mailboxes based on a custom attribute and compares specified attributes. It returns a list of mailboxes along with their primary SMTP address, the custom attribute value, and whether the specified attributes match. It's more or less a \`Get-ExoMailbox with specific filter ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-ExMailboxFromAttribute -Attribute "CustomAttribute" -CheckAttributes @("Attribute1", "Attribute2") ``` This example retrieves mailboxes with the custom attribute "CustomAttribute" and compares the values of "Attribute1" and "Attribute2". ### EXAMPLE 2 ```powershell theme={null} Get-ExMailboxFromAttribute -Attribute "CustomAttribute" ``` This example retrieves mailboxes with the custom attribute "CustomAttribute" without comparing any attributes. ### EXAMPLE 3 ```powershell theme={null} Get-ExMailboxFromAttribute -Attribute "CustomAttribute" -ExportToExcel ``` Exports results to an Excel file. ## PARAMETERS ### -Attribute The custom attribute to retrieve from the mailboxes. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: true ValueFromPipelineByPropertyName: true ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -CheckAttributes Optional. An array of two attributes to compare. If specified, the function checks if the values of these attributes match. Can be useful to compare two attributes for examples ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel If specified, exports the results to an Excel file in the user's profile directory. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String *Not documented.* ## OUTPUTS ## NOTES You can also use `Get-AttributeMatching` to compare two attributes directly in AD/Exchange/Entra ID ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-ExMailboxFromAttribute](https://ps365.clidsys.com/docs/commands/Get-ExMailboxFromAttribute) # Get-ExMailboxMaxSize Source: https://ps365.clidsys.com/docs/commands/Get-ExMailboxMaxSize Get Exchange Mailbox Max Send and Receive Size limits. # Get-ExMailboxMaxSize ## SYNOPSIS Get Exchange Mailbox Max Send and Receive Size limits. ## SYNTAX ```powershell theme={null} Get-ExMailboxMaxSize [[-Identity] ] [-ByDomain ] [-ExportToExcel] [-ExportPath ] ``` ## DESCRIPTION This function retrieves the maximum send and receive size limits for Exchange Online mailboxes. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-ExMailboxMaxSize ``` Retrieves the max send and receive size limits for all Exchange Online mailboxes. ### EXAMPLE 2 ```powershell theme={null} Get-ExMailboxMaxSize -ByDomain "contoso.com" ``` Retrieves the max send and receive size limits for mailboxes in the specified domain. ### EXAMPLE 3 ```powershell theme={null} Get-ExMailboxMaxSize -Identity "user@contoso.com" ``` Retrieves the max send and receive size limits for the specified mailbox. ### EXAMPLE 4 ```powershell theme={null} Get-ExMailboxMaxSize -ExportToExcel ``` Exports results to an Excel file. ## PARAMETERS ### -ByDomain The domain to filter mailboxes by their primary SMTP address. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel If specified, exports the results to an Excel file in the user's profile directory. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Identity The identity of the mailbox to retrieve. This can be the primary SMTP address, alias, or GUID. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: true ValueFromPipelineByPropertyName: true ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String *Not documented.* ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-ExMailboxMaxSize](https://ps365.clidsys.com/docs/commands/Get-ExMailboxMaxSize) # Get-ExMailboxOnMicrosoftAddress Source: https://ps365.clidsys.com/docs/commands/Get-ExMailboxOnMicrosoftAddress Lists Exchange Online mailboxes with an @onmicrosoft.com email address # Get-ExMailboxOnMicrosoftAddress ## SYNOPSIS Lists Exchange Online mailboxes with an @onmicrosoft.com email address ## SYNTAX ```powershell theme={null} Get-ExMailboxOnMicrosoftAddress [[-Identity] ] [-ByDomain ] [-ExportToExcel] [-ExportPath ] ``` ## DESCRIPTION Retrieves Exchange Online mailboxes that have an email address ending with @onmicrosoft.com. Returns an object for each mailbox with relevant details. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-ExMailboxOnMicrosoftAddress ``` Returns objects containing mailbox details for those with @onmicrosoft.com addresses. ### EXAMPLE 2 ```powershell theme={null} Get-ExMailboxOnMicrosoftAddress -ByDomain "contoso.com" ``` Returns mailboxes with @onmicrosoft.com addresses filtered by the specified domain. ### EXAMPLE 3 ```powershell theme={null} Get-ExMailboxOnMicrosoftAddress -Identity "user@contoso.com" ``` Returns the @onmicrosoft.com address for the specified mailbox identity. ### EXAMPLE 4 ```powershell theme={null} $mailboxes | Get-ExMailboxOnMicrosoftAddress ``` ### EXAMPLE 5 ```powershell theme={null} Get-ExMailboxOnMicrosoftAddress -ExportToExcel ``` Exports results to an Excel file. ## PARAMETERS ### -ByDomain *Not documented.* ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel If specified, exports the results to an Excel file in the user's profile directory. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Identity *Not documented.* ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: true ValueFromPipelineByPropertyName: true ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String\[] *Not documented.* ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-ExMailboxOnMicrosoftAddress](https://ps365.clidsys.com/docs/commands/Get-ExMailboxOnMicrosoftAddress) # Get-ExMailboxPermission Source: https://ps365.clidsys.com/docs/commands/Get-ExMailboxPermission Gets all permissions on an Exchange Online mailbox (Full Access, Send As, Send on Behalf) # Get-ExMailboxPermission ## SYNOPSIS Gets all permissions on an Exchange Online mailbox (Full Access, Send As, Send on Behalf) ## SYNTAX ```powershell theme={null} Get-ExMailboxPermission [[-Identity] ] [-ByDomain ] [-UserPermission ] [-ExportToExcel] [-ExportPath ] ``` ## DESCRIPTION This function retrieves and displays all permissions granted on a specific mailbox: * Full Access: Full access permissions to the mailbox * Send As: Permissions to send emails as the mailbox * Send on Behalf: Permissions to send emails on behalf of the mailbox ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-ExMailboxPermission -Identity "john.doe@contoso.com" ``` Gets all permissions for the mailbox [john.doe@contoso.com](mailto:john.doe@contoso.com) ### EXAMPLE 2 ```powershell theme={null} Get-ExMailboxPermission -Identity "john.doe@contoso.com" -ExportToExcel ``` Gets all permissions for the mailbox and exports them to an Excel file ### EXAMPLE 3 ```powershell theme={null} Get-ExMailboxPermission -ByDomain "contoso.com" ``` Gets all permissions for all mailboxes in the contoso.com domain ### EXAMPLE 4 ```powershell theme={null} Get-ExMailboxPermission -UserPermission "john.doe@contoso.com" ``` Finds all mailbox permissions that [john.doe@contoso.com](mailto:john.doe@contoso.com) has across all mailboxes ## PARAMETERS ### -ByDomain Filter mailboxes by domain name ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel Export the mailbox permissions to an Excel file ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Identity The identity of the mailbox (email address, username, or display name) ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: true ValueFromPipelineByPropertyName: true ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -UserPermission Find all permissions that a specific user has across all mailboxes (reverse lookup) ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String *Not documented.* ## OUTPUTS ## NOTES Requires the ExchangeOnlineManagement module and an active connection to Exchange Online For Excel export functionality, requires the ImportExcel module ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-ExMailboxPermission](https://ps365.clidsys.com/docs/commands/Get-ExMailboxPermission) # Get-ExMailboxProtocol Source: https://ps365.clidsys.com/docs/commands/Get-ExMailboxProtocol Retrieves mailbox protocol settings for Exchange Online mailboxes. # Get-ExMailboxProtocol ## SYNOPSIS Retrieves mailbox protocol settings for Exchange Online mailboxes. ## SYNTAX ```powershell theme={null} Get-ExMailboxProtocol [[-Identity] ] [-ByDomain ] [-ExportToExcel] [-ExportPath ] ``` ## DESCRIPTION This function retrieves the protocol settings (MAPI, OWA, IMAP, POP, EWS, ActiveSync) for Exchange Online mailboxes. It can filter mailboxes by identity or by domain. Additionally, it provides information about SMTP Client Authentication settings at both the mailbox and tenant levels. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-ExMailboxProtocol ``` Retrieves mailbox protocol settings for all Exchange Online mailboxes. ### EXAMPLE 2 ```powershell theme={null} Get-ExMailboxProtocol -Identity "user@example.com" ``` Retrieves mailbox protocol settings for the specified mailbox. ### EXAMPLE 3 ```powershell theme={null} Get-ExMailboxProtocol -ByDomain "example.com" ``` Retrieves mailbox protocol settings for all mailboxes in the specified domain. ### EXAMPLE 4 ```powershell theme={null} Get-ExMailboxProtocol -ExportToExcel ``` Exports mailbox protocol settings for all Exchange Online mailboxes to an Excel file in the user's profile directory. ## PARAMETERS ### -ByDomain The domain to filter mailboxes by. Only mailboxes with a primary SMTP address in this domain will be processed. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel If specified, exports the results to an Excel file in the user's profile directory. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Identity The identity of the mailbox to retrieve protocol settings for. If not specified, the function retrieves settings for all mailboxes. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: true ValueFromPipelineByPropertyName: true ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String *Not documented.* ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-ExMailboxProtocol](https://ps365.clidsys.com/docs/commands/Get-ExMailboxProtocol) # Get-ExMailboxQuotaInfo Source: https://ps365.clidsys.com/docs/commands/Get-ExMailboxQuotaInfo Reports the effective mailbox quota of each user against the storage their licenses entitle them to, including the new 100 GB entitlement of the Microsoft 365 Business suites. # Get-ExMailboxQuotaInfo ## SYNOPSIS Reports the effective mailbox quota of each user against the storage their licenses entitle them to, including the new 100 GB entitlement of the Microsoft 365 Business suites. ## SYNTAX ```powershell theme={null} Get-ExMailboxQuotaInfo [[-Identity] ] [-IncludeUsage] [-OnlyIssues] [-ForceNewToken] [-ExportToExcel] [-ExportPath ] ``` ## DESCRIPTION Since the 2026 Microsoft 365 packaging updates (rolled out June-September 2026), Business Basic, Business Standard and Business Premium include an additional 50 GB of primary mailbox storage, bringing the entitlement from 50 GB to 100 GB. The increase is delivered through a dedicated service plan: the Business Exchange plan (BPOS\_S\_STANDARD) grants 50 GB, and the add-on plan EXCHANGE\_STORAGE\_50GB adds the other 50 GB. Both must be enabled for the mailbox to reach 100 GB. This function crosses two sources, one row per mailbox: * Exchange Online: the effective quotas (IssueWarningQuota, ProhibitSendQuota, ProhibitSendReceiveQuota) * Microsoft Graph: the assigned SKUs and the enabled Exchange service plans of the user It computes the expected maximum quota of EVERY mailbox from the licenses (100 GB for Exchange Online Plan 2 or a Business suite with the storage add-on, 50 GB for Plan 1 alone or a license-free shared/room/equipment mailbox, 2 GB for Kiosk) and flags the gaps in the Issue column. A mailbox that cannot be evaluated is flagged too, so an empty Issue always means 'evaluated and consistent': * StorageAddOnNotProvisioned: Business suite license but the EXCHANGE\_STORAGE\_50GB plan is not enabled (disabled in the license options, or provisioning not completed yet) * QuotaBelowEntitlement: the add-on is there but ProhibitSendReceiveQuota is still below the entitlement (custom quota set by an administrator, preserved by design, or provisioning pending) * QuotaAboveEntitlement: ProhibitSendReceiveQuota exceeds what the current licenses entitle the user to (backfill applied on top of an already raised quota, or a 100 GB license since removed). Informational: the mailbox has more than its entitlement, not less * EntitlementUnknown (\): the user holds an Exchange service plan whose quota is not in the internal map: the row is NOT evaluated (report it so the map can be extended) * NoExchangeLicense: user mailbox without any Exchange service plan Quotas are never additive across products: a user holding both a Business suite and an Enterprise plan is entitled to 100 GB, not 150. Custom quotas set by an administrator are preserved by the rollout, which is exactly what this report surfaces. The increase concerns the primary mailbox only (no archive change). ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-ExMailboxQuotaInfo ``` Quotas versus license entitlement for every user, shared, room and equipment mailbox of the tenant. ### EXAMPLE 2 ```powershell theme={null} Get-ExMailboxQuotaInfo -OnlyIssues ``` Only the mailboxes whose quota does not match what the licenses entitle them to (Business suite without the +50 GB add-on, or quota still below the entitlement). ### EXAMPLE 3 ```powershell theme={null} Get-ExMailboxQuotaInfo -Identity 'user@contoso.com' ``` The report for a single user. ### EXAMPLE 4 ```powershell theme={null} Get-ExMailboxQuotaInfo -IncludeUsage ``` Same report with the current size of each mailbox and its usage percentage. ### EXAMPLE 5 ```powershell theme={null} Get-ExMailboxQuotaInfo -ExportToExcel ``` Exports the report to an Excel file in the user's profile directory. ## PARAMETERS ### -ExportPath (Optional) Output directory for the Excel export. Defaults to the user profile. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel (Optional) If specified, exports the results to an Excel file in the user's profile directory. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ForceNewToken Switch parameter to force getting a new token from Microsoft Graph. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Identity (Optional) One or more user principal names. When omitted, every user, shared, room and equipment mailbox of the tenant is evaluated. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: true ValueFromPipelineByPropertyName: true ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IncludeUsage (Optional) Also retrieves the current mailbox usage (Get-EXOMailboxStatistics): columns TotalItemSize, TotalItemSizeGB and UsagePercent (against ProhibitSendReceiveQuota). One extra call per mailbox: noticeably slower on large tenants. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -OnlyIssues (Optional) Returns only the mailboxes with a non-empty Issue column. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String\[] *Not documented.* ## OUTPUTS ### System.Collections.Generic.List\[PSCustomObject] *Not documented.* ### System.Collections.Generic.List\`1\[\[System.Management.Automation.PSObject, System.Management.Automation, Version=7.5.0.500, Culture=neutral, PublicKeyToken=31bf3856ad364e35]] *Not documented.* ## NOTES OUTPUT PROPERTIES * UserPrincipalName : the mailbox owner * DisplayName : display name of the mailbox * RecipientTypeDetails : UserMailbox, SharedMailbox... * ProhibitSendQuota : effective send quota reported by Exchange * ProhibitSendReceiveQuota : effective maximum size reported by Exchange * IssueWarningQuota : warning threshold reported by Exchange * UseDatabaseQuotaDefaults : whether the database defaults apply * TotalItemSize : current mailbox size (with -IncludeUsage, empty otherwise) * TotalItemSizeGB : current mailbox size in GB (with -IncludeUsage) * UsagePercent : TotalItemSizeGB / ProhibitSendReceiveQuota (with -IncludeUsage) * LicenseLookupStatus : Success or UserNotFoundInGraph * Licenses : SKU part numbers assigned to the user, or None * ExchangeServicePlans : enabled Exchange service plans (BPOS\_S\_STANDARD, EXCHANGE\_STORAGE\_50GB...), or None * HasBusinessSuite : the user holds Business Basic, Business Standard or Business Premium * HasStorageAddOn : the EXCHANGE\_STORAGE\_50GB service plan is enabled * ExpectedMaxQuotaGB : maximum quota the licenses entitle the user to (empty when unknown) * Issue : StorageAddOnNotProvisioned, QuotaBelowEntitlement, QuotaAboveEntitlement, EntitlementUnknown, NoExchangeLicense, or empty (evaluated and consistent) Required Microsoft Graph permissions: * User.Read.All * Organization.Read.All Requires an Exchange Online connection (Connect-ExchangeOnline is called when none exists). Mailboxes are retrieved with Get-EXOMailbox (REST) for performance on large tenants. Reference: [https://techcommunity.microsoft.com/blog/exchange/understanding-the-new-100-gb-mailbox-entitlement-for-microsoft-365-business-suit/4548243](https://techcommunity.microsoft.com/blog/exchange/understanding-the-new-100-gb-mailbox-entitlement-for-microsoft-365-business-suit/4548243) Version history: 1.0 - Creation. Crosses Exchange quotas with Graph service plans to check the 100 GB Business suites entitlement (BPOS\_S\_STANDARD + EXCHANGE\_STORAGE\_50GB), flags the missing add-on and the quotas below entitlement (custom quotas are preserved by the rollout by design). ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-ExMailboxQuotaInfo](https://ps365.clidsys.com/docs/commands/Get-ExMailboxQuotaInfo) # Get-ExMailboxRegionalConfiguration Source: https://ps365.clidsys.com/docs/commands/Get-ExMailboxRegionalConfiguration Get the regional configuration of Exchange Online mailboxes. # Get-ExMailboxRegionalConfiguration ## SYNOPSIS Get the regional configuration of Exchange Online mailboxes. ## SYNTAX ```powershell theme={null} Get-ExMailboxRegionalConfiguration [[-Identity] ] [-ByDomain ] [-ExportToExcel] [-ExportPath ] ``` ## DESCRIPTION This function retrieves the regional configuration settings (language, time zone, date format, time format) for Exchange Online mailboxes. It can filter mailboxes by identity or by domain. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-ExMailboxRegionalConfiguration ``` Retrieves the regional configuration for all Exchange Online mailboxes. ### EXAMPLE 2 ```powershell theme={null} Get-ExMailboxRegionalConfiguration -Identity "user@example.com" ``` Retrieves the regional configuration for the specified mailbox. ### EXAMPLE 3 ```powershell theme={null} Get-ExMailboxRegionalConfiguration -ByDomain "example.com" ``` Retrieves the regional configuration for all mailboxes in the specified domain. ### EXAMPLE 4 ```powershell theme={null} Get-ExMailboxRegionalConfiguration -ExportToExcel ``` Exports results to an Excel file. ## PARAMETERS ### -ByDomain The domain to filter mailboxes by. Only mailboxes with a primary SMTP address in this domain will be processed. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel If specified, exports the results to an Excel file in the user's profile directory. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Identity The identity of the mailbox to retrieve the regional configuration for. If not specified, the function retrieves the configuration for all mailboxes. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: true ValueFromPipelineByPropertyName: true ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String *Not documented.* ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-ExMailboxRegionalConfiguration](https://ps365.clidsys.com/docs/commands/Get-ExMailboxRegionalConfiguration) # Get-ExMailboxStatisticsInfo Source: https://ps365.clidsys.com/docs/commands/Get-ExMailboxStatisticsInfo Gets detailed mailbox statistics for Exchange Online including item count by type. # Get-ExMailboxStatisticsInfo ## SYNOPSIS Gets detailed mailbox statistics for Exchange Online including item count by type. ## SYNTAX ```powershell theme={null} Get-ExMailboxStatisticsInfo [[-Identity] ] [-IncludeFolderDetails] [-ExportToExcel] [-ExportPath ] ``` ## DESCRIPTION This function retrieves comprehensive statistics for an Exchange Online mailbox, including: * General statistics (size, total item count, etc.) * Item count by folder (Inbox, Sent Items, etc.) * Number of contacts * Number of calendar items * Number of tasks * Number of notes ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-ExMailboxStatisticsInfo ``` Gets detailed statistics for all Exchange Online mailboxes. ### EXAMPLE 2 ```powershell theme={null} Get-ExMailboxStatisticsInfo -Identity "user@domain.com" ``` Gets detailed statistics for the specified mailbox. ### EXAMPLE 3 ```powershell theme={null} Get-ExMailboxStatisticsInfo -Identity "user@domain.com" -IncludeFolderDetails ``` Gets statistics with folder details included. ### EXAMPLE 4 ```powershell theme={null} Get-ExMailboxStatisticsInfo -ExportToExcel ``` Exports results to an Excel file. ## PARAMETERS ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel If specified, exports the results to an Excel file in the user's profile directory. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Identity Mailbox identity (email address, username, etc.). If omitted, statistics are retrieved for all Exchange Online mailboxes. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: true ValueFromPipelineByPropertyName: true ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IncludeFolderDetails Include folder details in the results ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String *Not documented.* ## OUTPUTS ## NOTES Author: Bastien Perez Version: 1.0.0 ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-ExMailboxStatisticsInfo](https://ps365.clidsys.com/docs/commands/Get-ExMailboxStatisticsInfo) # Get-ExMailboxWorkingHours Source: https://ps365.clidsys.com/docs/commands/Get-ExMailboxWorkingHours Get the working hours configuration of Exchange Online mailboxes. # Get-ExMailboxWorkingHours ## SYNOPSIS Get the working hours configuration of Exchange Online mailboxes. ## SYNTAX ```powershell theme={null} Get-ExMailboxWorkingHours [[-Identity] ] [-ByDomain ] [-ExportToExcel] [-ExportPath ] ``` ## DESCRIPTION This function retrieves the working hours configuration from the calendar settings for Exchange Online mailboxes. It returns the time zone, start/end times, and enabled days for each mailbox. The function can filter mailboxes by identity or by domain. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-ExMailboxWorkingHours ``` Retrieves the working hours configuration for all Exchange Online mailboxes. ### EXAMPLE 2 ```powershell theme={null} Get-ExMailboxWorkingHours -Identity "user@example.com" ``` Retrieves the working hours configuration for the specified mailbox. ### EXAMPLE 3 ```powershell theme={null} Get-ExMailboxWorkingHours -ByDomain "example.com" ``` Retrieves the working hours configuration for all mailboxes in the specified domain. ### EXAMPLE 4 ```powershell theme={null} Get-ExMailboxWorkingHours -ExportToExcel ``` Exports results to an Excel file. ## PARAMETERS ### -ByDomain The domain to filter mailboxes by. Only mailboxes with a primary SMTP address in this domain will be processed. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel If specified, exports the results to an Excel file in the user's profile directory. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Identity The identity of the mailbox to retrieve the working hours configuration for. If not specified, the function retrieves the configuration for all mailboxes. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: true ValueFromPipelineByPropertyName: true ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String *Not documented.* ## OUTPUTS ## NOTES Requires connection to Exchange Online using Connect-ExchangeOnline. The function retrieves data from Get-MailboxCalendarConfiguration. ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-ExMailboxWorkingHours](https://ps365.clidsys.com/docs/commands/Get-ExMailboxWorkingHours) # Get-ExResourceMailbox Source: https://ps365.clidsys.com/docs/commands/Get-ExResourceMailbox Exports Exchange Online resource mailboxes and their calendar processing settings # Get-ExResourceMailbox ## SYNOPSIS Exports Exchange Online resource mailboxes and their calendar processing settings ## SYNTAX ```powershell theme={null} Get-ExResourceMailbox [[-PrimarySmtpAddress] ] [-Filter ] [-UseExchangeDNHash] [-ExportToExcel] ``` ## DESCRIPTION This function retrieves Exchange Online resource mailboxes (rooms and equipment) and their calendar processing parameters. It also includes a It also includes a "splatting" feature that deploys distribution groups to display all individual members. PARAMETER Filter Specifies filters to target specific mailboxes. If no filter is provided, all resource mailboxes will be returned. Example: '`{emailaddresses -like "*contoso.com"}`'' ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-ExResourceMailbox | Export-Csv c:\scripts\All365Mailboxes.csv -NoTypeInformation -Encoding UTF8 ``` Exports all resource mailboxes to a CSV file. ### EXAMPLE 2 ```powershell theme={null} Get-ExResourceMailbox -Filter '{emailaddresses -like "*contoso.com"}' -ExpandGroups | Export-Csv c:\scripts\365ResourceMailboxes.csv -NoTypeInformation -Encoding UTF8 ``` Exports resource mailboxes from the contoso.com domain with group expansion. ### EXAMPLE 3 ```powershell theme={null} Get-ExResourceMailbox -ExportToExcel ``` Exports results to an Excel file. ## PARAMETERS ### -ExportToExcel If specified, exports the results to an Excel file in the user's profile directory. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Filter *Not documented.* ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -PrimarySmtpAddress Specifies an array of primary SMTP addresses to retrieve specific mailboxes. If not specified, the function will automatically retrieve the mailboxes according to the filters. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: true ValueFromPipelineByPropertyName: true ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -UseExchangeDNHash Uses a hash of Exchange Legacy DNs to optimize performance when processing delegates and reservation strategies. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String\[] *Not documented.* ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-ExResourceMailbox](https://ps365.clidsys.com/docs/commands/Get-ExResourceMailbox) # Get-ExRoleReport Source: https://ps365.clidsys.com/docs/commands/Get-ExRoleReport Reports on Exchange RBAC roles and their effective membership, including groups expanded recursively. # Get-ExRoleReport ## SYNOPSIS Reports on Exchange RBAC roles and their effective membership, including groups expanded recursively. ## SYNTAX ```powershell theme={null} Get-ExRoleReport [[-Identity] ] [[-PrincipalID] ] [[-PrincipalDisplayName] ] [-OnPrem] ``` ## DESCRIPTION Produces a report of the membership of Exchange RBAC role groups. By default, the report contains only the roles that have at least one member. When a role member is itself a group (distribution group, mail-enabled security group, dynamic distribution group, or a nested role group), its members are resolved recursively and included in the report with DirectMember set to \$false and MemberViaGroup set to the name of the group that is a direct member of the role. Circular group references are detected and skipped automatically. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-ExRoleReport ``` Retrieves the Exchange RBAC role report for Exchange Online, including recursive group expansion. ### EXAMPLE 2 ```powershell theme={null} Get-ExRoleReport -Identity 'Organization Management' ``` Returns only the membership of the 'Organization Management' role group. ### EXAMPLE 3 ```powershell theme={null} Get-ExRoleReport -PrincipalID 'alice@contoso.com' ``` Returns every role assignment held by [alice@contoso.com](mailto:alice@contoso.com) (direct or via group membership). ### EXAMPLE 4 ```powershell theme={null} Get-ExRoleReport -PrincipalDisplayName 'Alice Doe' ``` Returns every role assignment held by the user whose DisplayName is 'Alice Doe'. ### EXAMPLE 5 ```powershell theme={null} Get-ExRoleReport | Where-Object { $_.DirectMember -eq $false } | Format-Table Role, MemberName, MemberViaGroup ``` Lists all users/objects resolved through group membership, showing which group is a direct member of the role. ### EXAMPLE 6 ```powershell theme={null} Get-ExRoleReport | Export-Csv -NoTypeInformation "$(Get-Date -Format yyyyMMdd)_adminRoles.csv" -Encoding UTF8 ``` Exports the full report (including group-expanded members) to a CSV file. ## PARAMETERS ### -Identity Filter the report on a specific role (matches the Role column, exact case-insensitive). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -OnPrem When specified, queries an on-premises Exchange server instead of Exchange Online. Group expansion is also performed for on-premises role groups. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -PrincipalDisplayName Filter the report on a specific MemberDisplayName (exact, case-insensitive). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 2 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -PrincipalID Filter the report on a specific principal. Matches MemberName (alias), MemberPrimarySMTPAddres (UPN/SMTP), or MemberObjectID (ExternalDirectoryObjectId / GUID). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 1 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ### \[System.Collections.Generic.List\[Object]] containing PSCustomObject rows with the following properties: Role *Not documented.* ## NOTES Requires ExchangeOnlineManagement module and an active Connect-ExchangeOnline session for Exchange Online. For on-premises Exchange, requires the Exchange Management Shell or the Exchange snap-in loaded. ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-ExRoleReport](https://ps365.clidsys.com/docs/commands/Get-ExRoleReport) # Get-IntuneAutoMDMEnrollmentPolicy Source: https://ps365.clidsys.com/docs/commands/Get-IntuneAutoMDMEnrollmentPolicy Retrieves the current MDM enrollment policy for Microsoft Entra ID. # Get-IntuneAutoMDMEnrollmentPolicy ## SYNOPSIS Retrieves the current MDM enrollment policy for Microsoft Entra ID. ## SYNTAX ```powershell theme={null} Get-IntuneAutoMDMEnrollmentPolicy [-AsObject] ``` ## DESCRIPTION This function retrieves the current state of automatic MDM enrollment during device registration in Microsoft Entra ID. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-IntuneAutoMDMEnrollmentPolicy ``` Retrieves the current MDM enrollment policy state (Enabled/Disabled). ### EXAMPLE 2 ```powershell theme={null} Get-IntuneAutoMDMEnrollmentPolicy -AsObject ``` Retrieves the complete policy object from Microsoft Graph. ## PARAMETERS ### -AsObject When specified, returns the complete policy object instead of just the state. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ### String - Returns 'Enabled' or 'Disabled' by default PSObject - Returns full policy object when -AsObject is used *Not documented.* ## NOTES Requires the following Microsoft Graph permissions: * Policy.Read.All Connect-MgGraph -Scopes 'Policy.Read.All' ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-IntuneAutoMDMEnrollmentPolicy](https://ps365.clidsys.com/docs/commands/Get-IntuneAutoMDMEnrollmentPolicy) # Get-IntuneODJConnectorServiceEventLog Source: https://ps365.clidsys.com/docs/commands/Get-IntuneODJConnectorServiceEventLog Retrieves and parses event logs from the Microsoft Intune ODJ (Offline Domain Join) Connector Service. # Get-IntuneODJConnectorServiceEventLog ## SYNOPSIS Retrieves and parses event logs from the Microsoft Intune ODJ (Offline Domain Join) Connector Service. ## SYNTAX ```powershell theme={null} Get-IntuneODJConnectorServiceEventLog [[-DeviceId] ] [[-DeviceName] ] ``` ## DESCRIPTION This function uses the Get-WinEvent cmdlet to filter and retrieve specific event logs related to the Microsoft Intune ODJ (Offline Domain Join) Connector Service. It parses the event messages to extract structured information such as ActivityId, DeviceId, DeviceName, and other diagnostic data. Intune ODJ Connector Service is responsible for creating Windows computer objects in Active Directory during the device enrollment process via Windows Autopilot. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-IntuneODJConnectorServiceEventLog ``` Retrieves and parses the event logs for the Microsoft Intune ODJ Connector Service, returning structured objects with parsed properties. ### EXAMPLE 2 ```powershell theme={null} Get-IntuneODJConnectorServiceEventLog | Where-Object { $_.DiagnosticCode -ne 0 } ``` Retrieves parsed event logs and filters for events with non-zero diagnostic codes (potential errors). ### EXAMPLE 3 ```powershell theme={null} Get-IntuneODJConnectorServiceEventLog -DeviceId 'e078603c-fe1a-488a-a760-415622ff9f45' ``` Retrieves event logs for a specific device ID. ### EXAMPLE 4 ```powershell theme={null} Get-IntuneODJConnectorServiceEventLog -DeviceName 'DESKTOP-*' ``` Retrieves event logs for devices with names matching the wildcard pattern. ## PARAMETERS ### -DeviceId Filters the results to show only events for the specified Device ID (GUID). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -DeviceName Filters the results to show only events for the specified Device Name. Supports wildcards. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 1 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES Must be executed on the server where the Microsoft Intune ODJ Connector Service is installed to access the relevant event logs. Requires local administrator privileges to read the event logs. Automatically resolves UserID to Active Directory account information (User, gMSA, Computer) when the ActiveDirectory module is available. ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-IntuneODJConnectorServiceEventLog](https://ps365.clidsys.com/docs/commands/Get-IntuneODJConnectorServiceEventLog) # Get-MessageTraceInfo Source: https://ps365.clidsys.com/docs/commands/Get-MessageTraceInfo Retrieves message trace information based on specified criteria. # Get-MessageTraceInfo ## SYNOPSIS Retrieves message trace information based on specified criteria. ## SYNTAX ```powershell theme={null} Get-MessageTraceInfo [[-SenderAddress] ] [[-RecipientAddress] ] [[-StartDate] ] [[-EndDate] ] [[-ByConnectorName] ] [[-ByTransportRuleName] ] [-UsingConnector] ``` ## DESCRIPTION This function retrieves message trace information from Exchange Online based on the specified criteria. It supports filtering by sender address, recipient address, start date, end date, connector name, transport rule name, and using connector flag. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-MessageTraceInfo -SenderAddress "john.doe@example.com" -RecipientAddress "jane.doe@example.com" -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -ByConnectorName "OutboundConnector" -UsingConnector ``` Retrieves message trace information for messages sent by "[john.doe@example.com](mailto:john.doe@example.com)" to "[jane.doe@example.com](mailto:jane.doe@example.com)" within the last 7 days, using the "OutboundConnector" connector. ### EXAMPLE 2 ```powershell theme={null} Get-MessageTraceInfo -RecipientAddress "jane.doe@example.com" -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) -ByTransportRuleName "Confidential" -UsingConnector ``` Retrieves message trace information for messages received by "[jane.doe@example.com](mailto:jane.doe@example.com)" within the last 30 days, filtered by the "Confidential" transport rule, using a connector. ## PARAMETERS ### -ByConnectorName Specifies the connector name to filter the message trace. This parameter accepts a string. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 4 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ByTransportRuleName Specifies the transport rule name to filter the message trace. This parameter accepts a string. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 5 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -EndDate Specifies the end date to filter the message trace. This parameter accepts a DateTime object. ```yaml theme={null} Type: System.DateTime DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 3 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -RecipientAddress Specifies the recipient address to filter the message trace. This parameter accepts a string or an array of strings. Wildcards (\*) can be used to match multiple recipient addresses. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 1 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -SenderAddress Specifies the sender address to filter the message trace. This parameter accepts a string or an array of strings. Wildcards (\*) can be used to match multiple sender addresses. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -StartDate Specifies the start date to filter the message trace. This parameter accepts a DateTime object. ```yaml theme={null} Type: System.DateTime DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 2 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -UsingConnector Specifies whether to filter the message trace using a connector. This parameter is a switch parameter. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES This function requires the Exchange Online PowerShell module to be installed and connected to an Exchange Online organization. For some event, it will fail to get messagetracedetail ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-MessageTraceInfo](https://ps365.clidsys.com/docs/commands/Get-MessageTraceInfo) # Get-MgApplicationAssignment Source: https://ps365.clidsys.com/docs/commands/Get-MgApplicationAssignment Retrieves all Entra ID applications and their assignment types. # Get-MgApplicationAssignment ## SYNOPSIS Retrieves all Entra ID applications and their assignment types. ## SYNTAX ### All (Default) ```powershell theme={null} Get-MgApplicationAssignment [-AllApplications] [-AssignmentNotEnforced] [-AssignmentEmpty] [-ExportToExcel] [-ExportPath ] [-DisableParallel] [-ThrottleLimit ] [-UseBatchRequest] ``` ### ByApplicationId ```powershell theme={null} Get-MgApplicationAssignment [[-ApplicationId] ] [-AssignmentNotEnforced] [-AssignmentEmpty] [-ExportToExcel] [-ExportPath ] [-DisableParallel] [-ThrottleLimit ] [-UseBatchRequest] ``` ### ByObjectId ```powershell theme={null} Get-MgApplicationAssignment [-ObjectID ] [-AssignmentNotEnforced] [-AssignmentEmpty] [-ExportToExcel] [-ExportPath ] [-DisableParallel] [-ThrottleLimit ] [-UseBatchRequest] ``` ### ByDisplayName ```powershell theme={null} Get-MgApplicationAssignment [-DisplayName ] [-AssignmentNotEnforced] [-AssignmentEmpty] [-ExportToExcel] [-ExportPath ] [-DisableParallel] [-ThrottleLimit ] [-UseBatchRequest] ``` ## DESCRIPTION This function returns a list of all Entra ID applications with their assignment information, identifying whether they are assigned to all users or have specific assignments. If no assignments exist, it indicates whether the application is available to "all users". Give information about assigned users, groups, or service principals and if the group is protected/static/dynamic. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-MgApplicationAssignment ``` Retrieves all applications and their assignment types. ### EXAMPLE 2 ```powershell theme={null} Get-MgApplicationAssignment -UseBatchRequest ``` Uses the Graph JSON \$batch endpoint to retrieve the app role assignments (20 requests per HTTP call, automatic 429 retry). ### EXAMPLE 3 ```powershell theme={null} Get-MgApplicationAssignment -DisableParallel ``` Forces sequential processing even on PowerShell 7+ (useful for debugging or to avoid concurrent Graph calls). ### EXAMPLE 4 ```powershell theme={null} Get-MgApplicationAssignment -ApplicationId "xxx", "yyy" ``` Retrieves assignment types for the specified application IDs. ### EXAMPLE 5 ```powershell theme={null} Get-MgApplicationAssignment -ObjectID '11111111-2222-3333-4444-555555555555' ``` Retrieves assignment types for the service principal matching this ObjectID. ### EXAMPLE 6 ```powershell theme={null} Get-MgApplicationAssignment -DisplayName 'My SAML App' ``` Retrieves assignment types for the service principal matching this DisplayName. ### EXAMPLE 7 ```powershell theme={null} Get-MgApplicationAssignment -AssignmentEmpty ``` Retrieves only applications with no specific user/group/service principal assignments. ### EXAMPLE 8 ```powershell theme={null} Get-MgApplicationAssignment -ExportToExcel ``` Gets all applications and exports them to an Excel file ## PARAMETERS ### -AllApplications (Optional) If specified, retrieves all service principals regardless of type. By default, only Enterprise Applications (tagged 'WindowsAzureActiveDirectoryIntegratedApp') are returned. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: All Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ApplicationId (Optional) One or more Application IDs (AppId) to filter the results. If not provided, all applications will be processed. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: ByApplicationId Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -AssignmentEmpty (Optional) If specified, only applications with no specific user/group/service principal assignments will be returned. Note: these apps may still be accessible to all users if AppRoleAssignmentRequired is \$false. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -AssignmentNotEnforced (Optional) If specified, only applications where AppRoleAssignmentRequired is \$false (open to all users, no assignment needed) will be returned. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -DisableParallel (Optional) Forces sequential processing. By default, on PowerShell 7+ the function analyzes applications in parallel (ForEach-Object -Parallel) to speed up processing; on PowerShell 5.1 it always runs sequentially. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -DisplayName (Optional) Display name of a single service principal to target (exact match, with fallback on trimmed comparison). Cannot be combined with -ApplicationId or -ObjectID. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: ByDisplayName Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel (Optional) If specified, exports the results to an Excel file in the user's profile directory. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ObjectID (Optional) ObjectID (GUID) of a single service principal to target. Cannot be combined with -ApplicationId or -DisplayName. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: - Identity ParameterSets: - Name: ByObjectId Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ThrottleLimit (Optional) Maximum number of concurrent runspaces when running in parallel. Default is 5. Keep this value moderate to avoid Microsoft Graph throttling (HTTP 429). ```yaml theme={null} Type: System.Int32 DefaultValue: 5 SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -UseBatchRequest (Optional) Uses the Microsoft Graph JSON \$batch endpoint (via Invoke-MgGraphBatchRequest, 20 requests per HTTP call with automatic HTTP 429 retry) to retrieve the app role assignments, instead of ForEach-Object -Parallel. Requires the PS365 module (Invoke-MgGraphBatchRequest); when the command is not available (e.g. script deployed standalone), the function warns and falls back to the default behavior. Note: the per-principal lookups (user, group, service principal details) are still performed individually. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-MgApplicationAssignment](https://ps365.clidsys.com/docs/commands/Get-MgApplicationAssignment) # Get-MgApplicationCredential Source: https://ps365.clidsys.com/docs/commands/Get-MgApplicationCredential Retrieves all Microsoft Entra ID applications and their credentials (key and password). # Get-MgApplicationCredential ## SYNOPSIS Retrieves all Microsoft Entra ID applications and their credentials (key and password). ## SYNTAX ### All (Default) ```powershell theme={null} Get-MgApplicationCredential [-ExportToExcel] [-ExportPath ] [-ForceNewToken] [-RunFromAzureAutomation] [-ExpirationThresholdDays ] [-NotificationRecipient ] [-NotificationSender ] [-DisableParallel] [-ThrottleLimit ] [-UseBatchRequest] ``` ### ByObjectId ```powershell theme={null} Get-MgApplicationCredential [-ObjectID ] [-ExportToExcel] [-ExportPath ] [-ForceNewToken] [-RunFromAzureAutomation] [-ExpirationThresholdDays ] [-NotificationRecipient ] [-NotificationSender ] [-DisableParallel] [-ThrottleLimit ] [-UseBatchRequest] ``` ### ByDisplayName ```powershell theme={null} Get-MgApplicationCredential [-DisplayName ] [-ExportToExcel] [-ExportPath ] [-ForceNewToken] [-RunFromAzureAutomation] [-ExpirationThresholdDays ] [-NotificationRecipient ] [-NotificationSender ] [-DisableParallel] [-ThrottleLimit ] [-UseBatchRequest] ``` ## DESCRIPTION This function returns a list of all Microsoft Entra ID applications with their credentials information, including key credentials and password credentials, along with their validity status. The function also retrieves the owners of each application. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-MgApplicationCredential ``` Retrieves all Microsoft Entra ID applications and their credentials. ### EXAMPLE 2 ```powershell theme={null} Get-MgApplicationCredential -UseBatchRequest ``` Uses the Graph JSON \$batch endpoint to retrieve the application owners (20 requests per HTTP call, automatic 429 retry). ### EXAMPLE 3 ```powershell theme={null} Get-MgApplicationCredential -DisableParallel ``` Forces sequential processing even on PowerShell 7+ (useful for debugging or to avoid concurrent Graph calls). ### EXAMPLE 4 ```powershell theme={null} Get-MgApplicationCredential -ObjectID "xxx-xxx-xxx" ``` Retrieves the credentials for a specific application by its ObjectID. ### EXAMPLE 5 ```powershell theme={null} Get-MgApplicationCredential -DisplayName "My Application" ``` Retrieves the credentials for a specific application by its DisplayName. ### EXAMPLE 6 ```powershell theme={null} Get-MgApplicationCredential -DisplayName "Azure*" ``` Retrieves the credentials for all applications whose DisplayName starts with "Azure". ### EXAMPLE 7 ```powershell theme={null} Get-MgApplicationCredential -DisplayName "*Portal*" ``` Retrieves the credentials for all applications whose DisplayName contains "Portal". ### EXAMPLE 8 ```powershell theme={null} Get-MgApplicationCredential -ForceNewToken ``` Forces the function to disconnect and reconnect to Microsoft Graph to obtain a new access token. ### EXAMPLE 9 ```powershell theme={null} Get-MgApplicationCredential -ExportToExcel ``` Gets all application credentials and exports them to an Excel file. ### EXAMPLE 10 ```powershell theme={null} Gets all application credentials using managed identity, exports them to an Excel file, and sends notification for credentials expiring within 15 days. ``` ### EXAMPLE 11 ```powershell theme={null} Get-MgApplicationCredential -RunFromAzureAutomation -ExpirationThresholdDays 30 -NotificationRecipient 'admin@company.com' -NotificationSender 'automation@company.com' ``` Gets all application credentials using managed identity authentication and sends notification for credentials expiring within 30 days. ### EXAMPLE 12 ```powershell theme={null} Get-MgApplicationCredential -RunFromAzureAutomation -ExpirationThresholdDays 7 -NotificationRecipient 'admin@company.com' -NotificationSender 'automation@company.com' ``` Gets all application credentials using managed identity and sends email notification for credentials expiring within 7 days. ## PARAMETERS ### -DisableParallel (Optional) Forces sequential processing. By default, on PowerShell 7+ the function processes applications in parallel (ForEach-Object -Parallel) to speed up discovery; on PowerShell 5.1 it always runs sequentially. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -DisplayName (Optional) Retrieves the credentials for a specific application by its DisplayName. Supports wildcards (\* and ?) for partial name matching (e.g. "Azure\*", "*Portal*"). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: ByDisplayName Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExpirationThresholdDays (Required when RunFromAzureAutomation is enabled) Number of days threshold for expiration notification. Default is 30 days. ```yaml theme={null} Type: System.Int32 DefaultValue: 30 SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel (Optional) If specified, exports the results to an Excel file in the user's profile directory. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ForceNewToken (Optional) Forces the function to disconnect and reconnect to Microsoft Graph to obtain a new access token. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -NotificationRecipient (Required when RunFromAzureAutomation is enabled) Email address to receive expiration notifications. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -NotificationSender (Required when RunFromAzureAutomation is enabled) Email address of the sender for expiration notifications. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ObjectID (Optional) Retrieves the credentials for a specific application by its ObjectID. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: - Identity ParameterSets: - Name: ByObjectId Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -RunFromAzureAutomation (Optional) If specified, uses managed identity authentication instead of interactive authentication. This is useful when running the script in Azure environments like Azure Functions, Logic Apps, or VMs with managed identity enabled. When this parameter is used, ExpirationThresholdDays, NotificationRecipient and NotificationSender are required. PowerShell modules used in Azure Automation must be a MAXIMUM of version 2.25.0 when using PowerShell \< 7.4.0, because starting from version 2.26.0, PowerShell 7.4.0 is required, and Azure Automation does not support it yet as of February 2026. For PowerShell 7.4.0+, there are no version restrictions. [https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3147](https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3147) [https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3151](https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3151) [https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3166](https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3166) ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ThrottleLimit (Optional) Maximum number of concurrent runspaces when running in parallel. Default is 5. Keep this value moderate to avoid Microsoft Graph throttling (HTTP 429). ```yaml theme={null} Type: System.Int32 DefaultValue: 5 SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -UseBatchRequest (Optional) Uses the Microsoft Graph JSON \$batch endpoint (via Invoke-MgGraphBatchRequest, 20 requests per HTTP call with automatic HTTP 429 retry) to retrieve the application owners, instead of ForEach-Object -Parallel. Requires the PS365 module (Invoke-MgGraphBatchRequest); when the command is not available (e.g. script deployed standalone), the function warns and falls back to the default behavior. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-MgApplicationCredential](https://ps365.clidsys.com/docs/commands/Get-MgApplicationCredential) # Get-MgApplicationExpiringCertAndKey Source: https://ps365.clidsys.com/docs/commands/Get-MgApplicationExpiringCertAndKey Retrieves Entra ID applications with expiring credentials or SAML certificates. # Get-MgApplicationExpiringCertAndKey ## SYNOPSIS Retrieves Entra ID applications with expiring credentials or SAML certificates. ## SYNTAX ```powershell theme={null} Get-MgApplicationExpiringCertAndKey [[-DaysUntilExpiry] ] [[-ExportPath] ] [-ForceNewToken] [-ExportToExcel] [-UseBatchRequest] ``` ## DESCRIPTION This function identifies all Entra ID applications that have credentials (keys/passwords) or SAML signing certificates that will expire within a specified number of days. It combines data from both regular application credentials and SAML-specific certificates to provide a comprehensive view of expiring security components. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-MgApplicationExpiringCertAndKey ``` Retrieves all applications with credentials or SAML certificates expiring within the next 30 days. ### EXAMPLE 2 ```powershell theme={null} Get-MgApplicationExpiringCertAndKey -UseBatchRequest ``` Retrieves the expiring credentials using the Graph JSON \$batch endpoint for the underlying functions. ### EXAMPLE 3 ```powershell theme={null} Get-MgApplicationExpiringCertAndKey -DaysUntilExpiry 7 ``` Retrieves all applications with credentials or SAML certificates expiring within the next 7 days. ### EXAMPLE 4 ```powershell theme={null} Get-MgApplicationExpiringCertAndKey -DaysUntilExpiry 60 -ExportToExcel ``` Gets all applications with credentials expiring within 60 days and exports to Excel. ## PARAMETERS ### -DaysUntilExpiry The number of days to check for expiring credentials. Applications with credentials expiring within this timeframe will be returned. Default is 30 days. ```yaml theme={null} Type: System.Int32 DefaultValue: 30 SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 1 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel Exports the results to an Excel file. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ForceNewToken *Not documented.* ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -UseBatchRequest (Optional) Passed through to Get-MgApplicationCredential and Get-MgApplicationSAML: uses the Microsoft Graph JSON \$batch endpoint (20 requests per HTTP call with automatic HTTP 429 retry) instead of ForEach-Object -Parallel. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES This function requires both Get-MgApplicationCredential and Get-MgApplicationSAML functions to be available. Author: Bastien Perez ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-MgApplicationExpiringCertAndKey](https://ps365.clidsys.com/docs/commands/Get-MgApplicationExpiringCertAndKey) # Get-MgApplicationSAML Source: https://ps365.clidsys.com/docs/commands/Get-MgApplicationSAML Retrieves all Entra ID applications configured for SAML SSO. # Get-MgApplicationSAML ## SYNOPSIS Retrieves all Entra ID applications configured for SAML SSO. ## SYNTAX ### All (Default) ```powershell theme={null} Get-MgApplicationSAML [-ForceNewToken] [-ExportToExcel] [-ExportPath ] [-RunFromAzureAutomation] [-ExpirationThresholdDays ] [-NotificationRecipient ] [-NotificationSender ] [-IncludeSignInStats] [-DisableParallel] [-ThrottleLimit ] [-UseBatchRequest] ``` ### ByObjectId ```powershell theme={null} Get-MgApplicationSAML [-ObjectID ] [-ForceNewToken] [-ExportToExcel] [-ExportPath ] [-RunFromAzureAutomation] [-ExpirationThresholdDays ] [-NotificationRecipient ] [-NotificationSender ] [-IncludeSignInStats] [-DisableParallel] [-ThrottleLimit ] [-UseBatchRequest] ``` ### ByDisplayName ```powershell theme={null} Get-MgApplicationSAML [-DisplayName ] [-ForceNewToken] [-ExportToExcel] [-ExportPath ] [-RunFromAzureAutomation] [-ExpirationThresholdDays ] [-NotificationRecipient ] [-NotificationSender ] [-IncludeSignInStats] [-DisableParallel] [-ThrottleLimit ] [-UseBatchRequest] ``` ## DESCRIPTION This function returns a list of all Entra ID applications configured for SAML Single Sign-On along with their SAML-related properties. Each row represents one SAML signing certificate (KeyCredential with Usage 'Sign'), so an application with multiple certificates will appear on multiple rows. The `SamlSigningCertificateIsPreferred` column identifies the currently active certificate: * True : this is the active signing certificate * False : this certificate exists on the application but is not currently active ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-MgApplicationSAML ``` Retrieves all Entra ID applications configured for SAML SSO. ### EXAMPLE 2 ```powershell theme={null} Get-MgApplicationSAML -UseBatchRequest ``` Uses the Graph JSON \$batch endpoint to retrieve the application owners (20 requests per HTTP call, automatic 429 retry). ### EXAMPLE 3 ```powershell theme={null} Get-MgApplicationSAML -DisableParallel ``` Forces sequential processing even on PowerShell 7+ (useful for debugging or to avoid concurrent Graph calls). ### EXAMPLE 4 ```powershell theme={null} Get-MgApplicationSAML -IncludeSignInStats ``` Retrieves all Entra ID applications configured for SAML SSO with sign-in statistics for the last 30 days. ### EXAMPLE 5 ```powershell theme={null} Get-MgApplicationSAML -ObjectID "xxx-xxx-xxx" ``` Retrieves the SAML configuration for a specific application by its ObjectID. ### EXAMPLE 6 ```powershell theme={null} Get-MgApplicationSAML -DisplayName "My SAML App" ``` Retrieves the SAML configuration for a specific application by its DisplayName. ### EXAMPLE 7 ```powershell theme={null} Get-MgApplicationSAML -DisplayName "Azure*" ``` Retrieves the SAML configuration for all applications whose DisplayName starts with "Azure". ### EXAMPLE 8 ```powershell theme={null} Get-MgApplicationSAML -DisplayName "*Portal*" ``` Retrieves the SAML configuration for all applications whose DisplayName contains "Portal". ### EXAMPLE 9 ```powershell theme={null} Get-MgApplicationSAML -ForceNewToken ``` Forces the function to disconnect and reconnect to Microsoft Graph to obtain a new access token. ### EXAMPLE 10 ```powershell theme={null} Get-MgApplicationSAML -ExportToExcel ``` Gets all SAML applications and exports them to an Excel file. ### EXAMPLE 11 ```powershell theme={null} Get-MgApplicationSAML -RunFromAzureAutomation -ExpirationThresholdDays 30 -NotificationRecipient 'admin@company.com' -NotificationSender 'automation@company.com' ``` Gets all SAML applications using managed identity authentication and sends notification for certificates expiring within 30 days. ### EXAMPLE 12 ```powershell theme={null} Get-MgApplicationSAML -RunFromAzureAutomation -ExpirationThresholdDays 7 -NotificationRecipient 'admin@company.com' -NotificationSender 'automation@company.com' ``` Gets all SAML applications using managed identity and sends email notification for certificates expiring within 7 days. ## PARAMETERS ### -DisableParallel (Optional) Forces sequential processing. By default, on PowerShell 7+ the function processes SAML applications in parallel (ForEach-Object -Parallel) to speed up discovery; on PowerShell 5.1 it always runs sequentially. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -DisplayName (Optional) Retrieves the SAML configuration for a specific application by its DisplayName. Supports wildcards (\* and ?) for partial name matching (e.g. "Azure\*", "*Portal*"). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: ByDisplayName Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExpirationThresholdDays (Required when RunFromAzureAutomation is enabled) Number of days threshold for expiration notification. Default is 30 days. ```yaml theme={null} Type: System.Int32 DefaultValue: 30 SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel (Optional) If specified, exports the results to an Excel file in the user's profile directory. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ForceNewToken (Optional) Forces the function to disconnect and reconnect to Microsoft Graph to obtain a new access token. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IncludeSignInStats (Optional) If specified, includes sign-in statistics for the last 30 days for each application. Requires AuditLog.Read.All permission. Please be advised that this process is time-consuming. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -NotificationRecipient (Required when RunFromAzureAutomation is enabled) Email address to receive expiration notifications. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -NotificationSender (Required when RunFromAzureAutomation is enabled) Email address of the sender for expiration notifications. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ObjectID (Optional) Retrieves the SAML configuration for a specific application by its ObjectID. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: - Identity ParameterSets: - Name: ByObjectId Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -RunFromAzureAutomation (Optional) If specified, uses managed identity authentication instead of interactive authentication. This is useful when running the script in Azure environments like Azure Functions, Logic Apps, or VMs with managed identity enabled. When this parameter is used, ExpirationThresholdDays, NotificationRecipient and NotificationSender are required. PowerShell modules used in Azure Automation must be a MAXIMUM of version 2.25.0 when using PowerShell \< 7.4.0, because starting from version 2.26.0, PowerShell 7.4.0 is required, and Azure Automation does not support it yet as of February 2026. For PowerShell 7.4.0+, there are no version restrictions. [https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3147](https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3147) [https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3151](https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3151) [https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3166](https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3166) ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ThrottleLimit (Optional) Maximum number of concurrent runspaces when running in parallel. Default is 5. Keep this value moderate to avoid Microsoft Graph throttling (HTTP 429). ```yaml theme={null} Type: System.Int32 DefaultValue: 5 SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -UseBatchRequest (Optional) Uses the Microsoft Graph JSON \$batch endpoint (via Invoke-MgGraphBatchRequest, 20 requests per HTTP call with automatic HTTP 429 retry) to retrieve the application owners, instead of ForEach-Object -Parallel. Requires the PS365 module (Invoke-MgGraphBatchRequest); when the command is not available (e.g. script deployed standalone), the function warns and falls back to the default behavior. Note: with -IncludeSignInStats, the sign-in statistics are still retrieved per application (not batched). ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES Limitations: The information about the SAML applications clams is not available in the Microsoft Graph API v1 but in [https://main.iam.ad.ext.azure.com/api/ApplicationSso/\<service-principal-id\>/FederatedSsoV2](https://main.iam.ad.ext.azure.com/api/ApplicationSso/\<service-principal-id\>/FederatedSsoV2) so we don't get them ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-MgApplicationSAML](https://ps365.clidsys.com/docs/commands/Get-MgApplicationSAML) # Get-MgApplicationSCIM Source: https://ps365.clidsys.com/docs/commands/Get-MgApplicationSCIM Retrieves all Entra ID applications configured for SCIM provisioning. # Get-MgApplicationSCIM ## SYNOPSIS Retrieves all Entra ID applications configured for SCIM provisioning. ## SYNTAX ### All (Default) ```powershell theme={null} Get-MgApplicationSCIM [-ExcludeAttributeMappings] [-IncludeFailedObjects] [-ForceNewToken] [-ExportToExcel] [-ExportPath ] [-RunFromAzureAutomation] [-NotificationRecipient ] [-NotificationSender ] [-DisableParallel] [-ThrottleLimit ] [-UseBatchRequest] [-EntraCloudSync] ``` ### ByObjectId ```powershell theme={null} Get-MgApplicationSCIM [-ObjectID ] [-ExcludeAttributeMappings] [-IncludeFailedObjects] [-ForceNewToken] [-ExportToExcel] [-ExportPath ] [-RunFromAzureAutomation] [-NotificationRecipient ] [-NotificationSender ] [-DisableParallel] [-ThrottleLimit ] [-UseBatchRequest] [-EntraCloudSync] ``` ### ByDisplayName ```powershell theme={null} Get-MgApplicationSCIM [-DisplayName ] [-ExcludeAttributeMappings] [-IncludeFailedObjects] [-ForceNewToken] [-ExportToExcel] [-ExportPath ] [-RunFromAzureAutomation] [-NotificationRecipient ] [-NotificationSender ] [-DisableParallel] [-ThrottleLimit ] [-UseBatchRequest] [-EntraCloudSync] ``` ## DESCRIPTION This function returns a list of all Entra ID applications with SCIM provisioning enabled, along with their synchronization job details and settings. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} $scimApps = Get-MgApplicationSCIM ``` Retrieves all Entra ID applications with SCIM provisioning enabled. ### EXAMPLE 2 ```powershell theme={null} Get-MgApplicationSCIM -DisableParallel ``` Forces sequential processing even on PowerShell 7+ (useful for debugging or to avoid concurrent Graph calls). ### EXAMPLE 3 ```powershell theme={null} Get-MgApplicationSCIM -UseBatchRequest ``` Uses the Graph JSON \$batch endpoint for the discovery phase (20 requests per HTTP call, automatic 429 retry). Requires the PS365 module; falls back to the default behavior when Invoke-MgGraphBatchRequest is not available. ### EXAMPLE 4 ```powershell theme={null} Get-MgApplicationSCIM -EntraCloudSync ``` Returns only Entra Cloud Sync jobs, excluding application provisioning (SCIM) jobs. ### EXAMPLE 5 ```powershell theme={null} Get-MgApplicationSCIM -ForceNewToken ``` Forces the function to disconnect and reconnect to Microsoft Graph to obtain a new access token. ### EXAMPLE 6 ```powershell theme={null} Get-MgApplicationSCIM -ExportToExcel ``` Exports the SCIM configuration details to an Excel file. ### EXAMPLE 7 ```powershell theme={null} Get-MgApplicationSCIM -ObjectID "xxx-xxx-xxx" ``` Retrieves the SCIM configuration for a specific application by its ObjectID. ### EXAMPLE 8 ```powershell theme={null} Get-MgApplicationSCIM -DisplayName "My App" ``` Retrieves the SCIM configuration for a specific application by its DisplayName. ### EXAMPLE 9 ```powershell theme={null} Get-MgApplicationSCIM -DisplayName "Azure*" ``` Retrieves the SCIM configuration for all applications whose DisplayName starts with "Azure". ### EXAMPLE 10 ```powershell theme={null} Get-MgApplicationSCIM -DisplayName "*Provisioning*" ``` Retrieves the SCIM configuration for all applications whose DisplayName contains "Provisioning". ### EXAMPLE 11 ```powershell theme={null} Get-MgApplicationSCIM -RunFromAzureAutomation -NotificationRecipient 'admin@company.com' -NotificationSender 'automation@company.com' ``` Gets all SCIM provisioning jobs using managed identity and sends a health report for apps with synchronization issues. ## PARAMETERS ### -DisableParallel (Optional) Forces sequential processing. By default, on PowerShell 7+ the function scans service principals in parallel (ForEach-Object -Parallel) to speed up discovery; on PowerShell 5.1 it always runs sequentially. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -DisplayName (Optional) Retrieves the SCIM configuration for a specific application by its DisplayName. Supports wildcards (\* and ?) for partial name matching (e.g. "Azure\*", "*Portal*"). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: ByDisplayName Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -EntraCloudSync (Optional) Returns only Entra Cloud Sync jobs (synchronization templateId 'AD2AADProvisioning' or 'AD2AADPasswordHash'), excluding application provisioning (SCIM) jobs. Note: Microsoft Graph has no tenant-wide endpoint to list synchronization jobs by templateId; jobs are nested per service principal, so this filter is applied client-side after enumerating service principals. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExcludeAttributeMappings (Optional) If specified, skips the retrieval of the attribute mapping schema (ObjectMappings). This speeds up execution significantly when mapping details are not needed. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel (Optional) If specified, exports the results to an Excel file in the user's profile directory. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ForceNewToken (Optional) Forces the function to disconnect and reconnect to Microsoft Graph to obtain a new access token. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IncludeFailedObjects (Optional) If specified, fetches the list of objects currently in error (escrowed) for each synchronization job via the provisioning audit logs API. Requires the AuditLog.Read.All permission. If connecting interactively, this scope is added automatically. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -NotificationRecipient (Required when RunFromAzureAutomation is enabled) Email address to receive synchronization health notifications. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -NotificationSender (Required when RunFromAzureAutomation is enabled) Email address of the sender for synchronization health notifications. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ObjectID (Optional) Retrieves the SCIM configuration for a specific application by its ObjectID. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: - Identity ParameterSets: - Name: ByObjectId Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -RunFromAzureAutomation (Optional) If specified, uses managed identity authentication instead of interactive authentication. This is useful when running the script in Azure environments like Azure Functions, Logic Apps, or VMs with managed identity enabled. When this parameter is used, NotificationRecipient and NotificationSender are required. PowerShell modules used in Azure Automation must be a MAXIMUM of version 2.25.0 when using PowerShell \< 7.4.0, because starting from version 2.26.0, PowerShell 7.4.0 is required, and Azure Automation does not support it yet as of February 2026. For PowerShell 7.4.0+, there are no version restrictions. [https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3147](https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3147) [https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3151](https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3151) [https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3166](https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3166) ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ThrottleLimit (Optional) Maximum number of concurrent runspaces when running in parallel. Default is 5. Keep this value moderate to avoid Microsoft Graph throttling (HTTP 429). ```yaml theme={null} Type: System.Int32 DefaultValue: 5 SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -UseBatchRequest (Optional) Uses the Microsoft Graph JSON \$batch endpoint (via Invoke-MgGraphBatchRequest, 20 requests per HTTP call with automatic HTTP 429 retry) for the synchronization jobs discovery phase, instead of ForEach-Object -Parallel. Requires the PS365 module (Invoke-MgGraphBatchRequest); when the command is not available (e.g. script deployed standalone), the function warns and falls back to the default behavior. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES LIMITATIONS The groups assignments are not retrieved because based on [https://main.iam.ad.ext.azure.com](https://main.iam.ad.ext.azure.com) This function requires the Microsoft.Graph.Applications and Microsoft.Graph.Authentication modules. ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-MgApplicationSCIM](https://ps365.clidsys.com/docs/commands/Get-MgApplicationSCIM) # Get-MgAuditLogSigninInfo Source: https://ps365.clidsys.com/docs/commands/Get-MgAuditLogSigninInfo Get Microsoft Entra ID Audit Log Sign-In Details # Get-MgAuditLogSigninInfo ## SYNOPSIS Get Microsoft Entra ID Audit Log Sign-In Details ## SYNTAX ```powershell theme={null} Get-MgAuditLogSigninInfo [[-StartDate] ] [[-EndDate] ] [[-Users] ] [[-LastXSignIns] ] [[-IPAddresses] ] [[-ConditionalAccessPolicyName] ] [[-TimeRange] ] [-BasicAuthenticationOnly] [-SuccessOnly] [-FailureOnly] [-BadCredentialsOnly] [-LastLogonOnly] [-NonMFASignInsOnly] [-MFASignInsOnly] [-SmsVoiceMFASignInsOnly] [-NonInteractiveSignIns] [-ServicePrincipalSignIns] [-ManagedIdentitySignIns] [-ConditionalAccessPolicyNotApplied] [-ConditionalAccessPolicySuccessOnly] [-ConditionalAccessPolicyFailedOnly] [-UseDatePicker] [-ForceNewToken] [-AnalyzeCAPInReportOnly] [-ExportToExcel] ``` ## DESCRIPTION Get Microsoft Entra ID Audit Log Sign-In Details with various filtering options. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-MgAuditLogSigninInfo -StartDate '2024-01-01' -EndDate '2024-01-31' -Users 'user1@contoso.com', 'user2@contoso.com' ``` Retrieves sign-in logs for specified users between January 1, 2024, and January 31, 2024. ### EXAMPLE 2 ```powershell theme={null} Get-MgAuditLogSigninInfo -LastXSignIns 100 -FailureOnly ``` Retrieves the last 100 failed sign-in attempts. ### EXAMPLE 3 ```powershell theme={null} Get-MgAuditLogSigninInfo -AnalyzeCAPInReportOnly ``` Retrieves sign-in logs with Conditional Access applied in ReportOnly mode. ### EXAMPLE 4 ```powershell theme={null} Get-MgAuditLogSigninInfo -StartDate (Get-Date).AddHours(-1) -NonMFASignInsOnly ``` Retrieves non-MFA sign-ins from the last hour. ### EXAMPLE 5 ```powershell theme={null} Get-MgAuditLogSigninInfo -TimeRange Maximum -SmsVoiceMFASignInsOnly -ExportToExcel ``` Exports the sign-ins where SMS or voice call MFA was actually used over the full log retention, to identify who still relies on the methods retired on February 1, 2027. ## PARAMETERS ### -AnalyzeCAPInReportOnly Switch to filter sign-ins with Conditional Access applied in ReportOnly mode. Only sign-ins where the policy was used (exclude 'NotApplied') are returned. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -BadCredentialsOnly Switch to filter sign-ins with bad username or password (error code 50126). ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -BasicAuthenticationOnly Switch to filter sign-ins using legacy authentication protocols. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ConditionalAccessPolicyFailedOnly Switch to filter sign-ins where the Conditional Access Policy evaluation failed. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ConditionalAccessPolicyName Filter sign-ins by a specific Conditional Access Policy Name. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 5 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ConditionalAccessPolicyNotApplied Switch to filter sign-ins where the Conditional Access Policy was not applied. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ConditionalAccessPolicySuccessOnly Switch to filter sign-ins where the Conditional Access Policy evaluation was successful. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -EndDate The end date for filtering sign-in logs. Accepts either a DateTime object or a string in yyyy-MM-dd format. ```yaml theme={null} Type: System.Object DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 1 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel Switch to export the sign-in details report to an Excel file. The file will be saved in the user's profile directory with a timestamped filename. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -FailureOnly Switch to filter only failed sign-in attempts. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ForceNewToken Switch to force the acquisition of a new authentication token. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IPAddresses A comma-separated list of IP addresses to filter the sign-in logs. ```yaml theme={null} Type: System.Int32 DefaultValue: 0 SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 4 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -LastLogonOnly Switch to get only the last logon details for each user. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -LastXSignIns The number of most recent sign-ins to retrieve. The other filters (StartDate, EndDate, Users, etc.) will still apply. ```yaml theme={null} Type: System.Int32 DefaultValue: 0 SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 3 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ManagedIdentitySignIns Switch to filter managed identity sign-ins only. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -MFASignInsOnly Switch to filter MFA sign-ins only. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -NonInteractiveSignIns Switch to filter non-interactive sign-ins only. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -NonMFASignInsOnly Switch to filter non-MFA sign-ins only. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ServicePrincipalSignIns Switch to filter service principal sign-ins only. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -SmsVoiceMFASignInsOnly Switch to return only the sign-ins where a deprecated MFA method was actually used and succeeded: SMS (Text message) or voice call (Phone call), both retired by Microsoft on February 1, 2027. The detection reads the authentication steps (authenticationDetails) and the MFA detail of each sign-in, so it reflects real usage, unlike the registration reports which only say what users have enrolled. The filter is applied client-side: Microsoft Graph does not allow filtering on authenticationDetails server-side. See [https://itpro-tips.com/microsoft-entra-scheduled-end-of-life-for-sms-and-voice-call-mfa/](https://itpro-tips.com/microsoft-entra-scheduled-end-of-life-for-sms-and-voice-call-mfa/) ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -StartDate The start date for filtering sign-in logs. Accepts either a DateTime object or a string in yyyy-MM-dd format. ```yaml theme={null} Type: System.Object DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -SuccessOnly Switch to filter only successful sign-in attempts. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -TimeRange Remplace plusieurs switches par un seul paramètre avec ValidateSet ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 6 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -UseDatePicker Switch to open an interactive calendar dialog to select StartDate and EndDate visually. Requires Windows with .NET Windows Forms support (Windows PowerShell or pwsh on Windows). Any values already provided via -StartDate or -EndDate are used as the initial selection in the pickers. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Users An array of user principal names to filter the sign-in logs. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 2 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-MgAuditLogSigninInfo](https://ps365.clidsys.com/docs/commands/Get-MgAuditLogSigninInfo) # Get-MgBitlockerKeyInfo Source: https://ps365.clidsys.com/docs/commands/Get-MgBitlockerKeyInfo Invokes the backup of BitLocker recovery keys to Intune for all Intune managed devices. # Get-MgBitlockerKeyInfo ## SYNOPSIS Invokes the backup of BitLocker recovery keys to Intune for all Intune managed devices. ## SYNTAX ### Default (Default) ```powershell theme={null} Get-MgBitlockerKeyInfo [-IncludeDeviceInfo] [-IncludeDeviceOwner] [-ExportToExcel] [-ExportPath ] [-ShowKeyInPlainText] [-RunFromAzureAutomation] [-DeviceName ] [-DeviceID ] ``` ### KeyVault ```powershell theme={null} Get-MgBitlockerKeyInfo -BackupToKeyVault -KeyVaultName [-IncludeDeviceInfo] [-IncludeDeviceOwner] [-ExportToExcel] [-ExportPath ] [-ShowKeyInPlainText] [-RunFromAzureAutomation] [-DeviceName ] [-DeviceID ] ``` ## DESCRIPTION This script connects to Microsoft Intune and retrieves BitLocker recovery keys from all devices managed by Intune. It requires the Microsoft Graph PowerShell SDK to be installed and appropriate permissions to access device management and BitLocker key data. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-MgBitlockerKeyInfo -IncludeDeviceInfo -IncludeDeviceOwner ``` This command retrieves BitLocker recovery keys for all Intune managed devices with device and owner information. ### EXAMPLE 2 ```powershell theme={null} Get-MgBitlockerKeyInfo -IncludeDeviceInfo -ExportToExcel ``` This command retrieves BitLocker keys with device information and exports to Excel. ### EXAMPLE 3 ```powershell theme={null} Get-MgBitlockerKeyInfo -IncludeDeviceInfo -IncludeDeviceOwner -ShowKeyInPlainText -ExportToExcel ``` This command generates a comprehensive report with BitLocker keys visible in plain text and exports to Excel. WARNING: Use with extreme caution as this exposes sensitive recovery keys! ### EXAMPLE 4 ```powershell theme={null} Get-MgBitlockerKeyInfo -IncludeDeviceInfo -BackupToKeyVault -KeyVaultName "MyBitLockerVault" -ExportToExcel ``` This command retrieves BitLocker keys, backs them up to the specified Azure Key Vault, and exports to Excel. ### EXAMPLE 5 ```powershell theme={null} Get-MgBitlockerKeyInfo -RunFromAzureAutomation -IncludeDeviceInfo -ExportToExcel ``` This command retrieves BitLocker keys using managed identity authentication and exports to Excel. Suitable for Azure Automation runbooks. ### EXAMPLE 6 ```powershell theme={null} Get-MgBitlockerKeyInfo -DeviceName "LAPTOP-ABC123" -IncludeDeviceInfo -ShowKeyInPlainText ``` This command retrieves BitLocker keys for a specific device by name, includes device information, and displays keys in plain text. ### EXAMPLE 7 ```powershell theme={null} Get-MgBitlockerKeyInfo -DeviceID "12345678-1234-1234-1234-123456789abc" -ExportToExcel ``` This command retrieves BitLocker keys for a specific device by ID and exports the results to Excel. ## PARAMETERS ### -BackupToKeyVault Switch to enable backup of BitLocker recovery keys to Azure Key Vault. Must be used together with -KeyVaultName. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: KeyVault Position: Named IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -DeviceID Filter results to a specific device by its device ID (GUID). Cannot be used together with DeviceName parameter. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -DeviceName Filter results to a specific device by its display name. Cannot be used together with DeviceID parameter. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel Switch to export the results to an Excel file in the user profile directory. If not specified, the function returns the data objects. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IncludeDeviceInfo Switch to include device information such as device name, OS, compliance status, etc. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IncludeDeviceOwner Switch to include device owner information (UPN). Requires IncludeDeviceInfo parameter. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -KeyVaultName Specify the name of Azure Key Vault to backup BitLocker recovery keys. Mandatory when -BackupToKeyVault is specified. Requires Azure PowerShell module and appropriate permissions to access Key Vault. Keys will be stored with device name and BitLocker key ID as the secret name. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: KeyVault Position: Named IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -RunFromAzureAutomation (Optional) If specified, uses managed identity authentication instead of interactive authentication. This is useful when running the script in Azure environments like Azure Functions, Logic Apps, or VMs with managed identity enabled. PowerShell modules used in Azure Automation must be a MAXIMUM of version 2.25.0 when using PowerShell \< 7.4.0, because starting from version 2.26.0, PowerShell 7.4.0 is required, and Azure Automation does not support it yet as of February 2026. For PowerShell 7.4.0+, there are no version restrictions. [https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3147](https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3147) [https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3151](https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3151) [https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3166](https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3166) ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ShowKeyInPlainText Switch to display BitLocker recovery keys in plain text format in the output. WARNING: This will expose sensitive BitLocker recovery keys! Only use when absolutely necessary and ensure secure handling of the output. Without this parameter, keys will be hidden for security (displayed as '\[HIDDEN]'). ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES Author: Bastien Perez (adapted from Vasil Michev) Source: [https://github.com/michevnew/PowerShell/blob/master/GraphSDK\_Bitlocker\_report.ps1](https://github.com/michevnew/PowerShell/blob/master/GraphSDK_Bitlocker_report.ps1) The script requires the following Microsoft Graph permissions: * BitLockerKey.Read.All (required) - Allows the app to read BitLocker keys on behalf of the signed-in user, for their owned devices. Allows read of the recovery key. * Device.Read.All (optional) - Needed to retrieve device details like name, OS, compliance status * User.ReadBasic.All (optional) - Needed to retrieve device owner UPN information PERMISSION SCOPE CONSIDERATIONS: * User context: Can only read BitLocker keys for devices owned by the signed-in user (if you have admin permissions, you can read all devices and all bitlocker keys) * Application context: Can read BitLocker keys for all devices in the organization (requires admin consent) * Managed Identity: Same as application context when properly configured with admin consent SECURITY WARNING: The exported CSV file contains sensitive BitLocker recovery keys. Store it in a secure location and limit access appropriately! ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-MgBitlockerKeyInfo](https://ps365.clidsys.com/docs/commands/Get-MgBitlockerKeyInfo) # Get-MgCustomSecurityAttributeInfo Source: https://ps365.clidsys.com/docs/commands/Get-MgCustomSecurityAttributeInfo Reports custom security attributes assigned to users, devices, and service principals (enterprise apps) in Microsoft Entra ID. # Get-MgCustomSecurityAttributeInfo ## SYNOPSIS Reports custom security attributes assigned to users, devices, and service principals (enterprise apps) in Microsoft Entra ID. ## SYNTAX ```powershell theme={null} Get-MgCustomSecurityAttributeInfo [[-AttributeSet] ] [-EntityType ] [-OnlyAssigned] [-UnusedOnly] [-ForceNewToken] [-ExportToExcel] [-ExportPath ] ``` ## DESCRIPTION Queries Microsoft Graph to enumerate custom security attribute assignments across users, devices, and service principals. Auto-discovers all attribute sets in the tenant, or restricts the scope to a single set when -AttributeSet is provided. The output is one row per (entity, attribute set, attribute name, value) so it can be filtered/pivoted easily. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-MgCustomSecurityAttributeInfo ``` Auto-discovers all attribute sets and returns assignments across users, devices, and service principals. ### EXAMPLE 2 ```powershell theme={null} Get-MgCustomSecurityAttributeInfo -AttributeSet 'ComplianceData' ``` Returns assignments only for the 'ComplianceData' attribute set. ### EXAMPLE 3 ```powershell theme={null} Get-MgCustomSecurityAttributeInfo -EntityType User, ServicePrincipal ``` Returns assignments only for users and service principals (skips devices). ### EXAMPLE 4 ```powershell theme={null} Get-MgCustomSecurityAttributeInfo -UnusedOnly ``` Returns only the attribute definitions assigned to nobody, with their set and their status. ### EXAMPLE 5 ```powershell theme={null} Get-MgCustomSecurityAttributeInfo -ExportToExcel ``` Exports results to an Excel file in the user's profile directory, with one worksheet per entity type, plus an 'Unused' worksheet listing the definitions nobody uses. ## PARAMETERS ### -AttributeSet Restricts the report to a single attribute set name. If omitted, all attribute sets discovered in the tenant are reported. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -EntityType Limits the entity types scanned. Valid values: User, Device, ServicePrincipal. Default is all three. ```yaml theme={null} Type: System.String[] DefaultValue: "@('User', 'Device', 'ServicePrincipal')" SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel (Optional) If specified, exports the results to an Excel file in the user's profile directory. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ForceNewToken Switch parameter to force getting a new token from Microsoft Graph. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -OnlyAssigned If specified, only entities that actually have at least one custom security attribute assignment are returned. This is the default behavior; the switch is kept for explicit/discoverable usage. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -UnusedOnly Returns the attribute definitions that exist in the tenant but are assigned to no entity, instead of the assignments themselves. These are the cleanup candidates: a definition nobody uses still shows up in every attribute picker and still has to be governed. The scan is the same either way, so the count is always reported, whether or not this switch is present. The count is only trustworthy when every entity type was scanned without error. With a restricted -EntityType, or after an entity read failure, the result is reported as scoped: an attribute assigned only on a skipped entity type would otherwise look unused. A failure to read the definitions themselves is different: there is nothing to compare the assignments against, so the unused report is unavailable rather than scoped. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ### System.Management.Automation.PSObject *Not documented.* ## NOTES Required Microsoft Graph permissions: * CustomSecAttributeDefinition.Read.All * CustomSecAttributeAssignment.Read.All * User.Read.All * Device.Read.All * Application.Read.All The custom security attribute on devices is in preview at the time of writing and uses the Graph beta endpoint. Reading customSecurityAttributes requires the caller to be granted the 'Attribute Assignment Reader' (or higher) directory role in addition to the application/delegated permissions above. ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-MgCustomSecurityAttributeInfo](https://ps365.clidsys.com/docs/commands/Get-MgCustomSecurityAttributeInfo) # Get-MgDirectorySyncInfo Source: https://ps365.clidsys.com/docs/commands/Get-MgDirectorySyncInfo Reports the identities that can synchronize Active Directory to Entra ID: the Connect Sync applications and the legacy synchronization accounts. # Get-MgDirectorySyncInfo ## SYNOPSIS Reports the identities that can synchronize Active Directory to Entra ID: the Connect Sync applications and the legacy synchronization accounts. ## SYNTAX ```powershell theme={null} Get-MgDirectorySyncInfo [[-DaysUntilExpiry] ] [[-StaleAfterDays] ] [[-ExportPath] ] [-ForceNewToken] [-ExportToExcel] ``` ## DESCRIPTION Microsoft Entra Connect Sync used to authenticate with a directory synchronization account, the Sync\_\\_\ user holding the Directory Synchronization Accounts role. It now authenticates with an application identity: a certificate on an application that carries the ADSynchronization.ReadWrite.All application role on the first-party Microsoft Entra AD Synchronization Service (AppId 6bf85cfa-ac8a-4be5-b5de-425a0d0dc016). Moving to the application does not remove the account. Microsoft documents that removal as a separate manual step, so a tenant that has migrated usually still carries the old account, still in a privileged role, used by nobody. This function reports both mechanisms in one list, because it is their coexistence that has to be read: * which application actually synchronizes today, and when its certificate expires. An expired certificate stops synchronization entirely, so this is an availability matter as much as a security one; * which synchronization accounts remain, and whether they still sign in. An account that has not signed in since the migration is the leftover to remove. A tenant is limited to 20 synchronization accounts, and leftovers count against that limit. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-MgDirectorySyncInfo ``` Lists the synchronization applications and the synchronization accounts, with their status. ### EXAMPLE 2 ```powershell theme={null} Get-MgDirectorySyncInfo -DaysUntilExpiry 60 ``` Widens the certificate warning to 60 days, to catch the next rollover before the maintenance window closes. ### EXAMPLE 3 ```powershell theme={null} Get-MgDirectorySyncInfo -ExportToExcel ``` Exports the report to an Excel file in the user's profile directory. ## PARAMETERS ### -DaysUntilExpiry Number of days below which a certificate is reported as expiring. Default 30. ```yaml theme={null} Type: System.Int32 DefaultValue: 30 SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath Optional output directory for the Excel export. Defaults to the user profile. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 2 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel Exports the result to an Excel file in the user's profile directory instead of returning it. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ForceNewToken Forces a new token to be requested from Microsoft Graph. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -StaleAfterDays Number of days without a sign-in above which a synchronization account is reported as stale. Default 30. ```yaml theme={null} Type: System.Int32 DefaultValue: 30 SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 1 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES Required Microsoft Graph permissions: * Application.Read.All * Directory.Read.All Optional: * AuditLog.Read.All AuditLog.Read.All is only needed for the last sign-in of the synchronization accounts, so it is requested but not required. Without it the accounts are still listed, with the Unknown status rather than presented as stale: an account that cannot be shown to be idle must not be offered for deletion. ## RELATED LINKS * [https://learn.microsoft.com/entra/identity/hybrid/connect/authenticate-application-id](https://learn.microsoft.com/entra/identity/hybrid/connect/authenticate-application-id) * [https://ps365.clidsys.com/docs/commands/Get-MgDirectorySyncInfo](https://ps365.clidsys.com/docs/commands/Get-MgDirectorySyncInfo) # Get-MgExtensionAttributeInfo Source: https://ps365.clidsys.com/docs/commands/Get-MgExtensionAttributeInfo Inventories the custom attributes usable in Entra ID dynamic group rules: the 15 built-in extension attributes and the directory extensions. # Get-MgExtensionAttributeInfo ## SYNOPSIS Inventories the custom attributes usable in Entra ID dynamic group rules: the 15 built-in extension attributes and the directory extensions. ## SYNTAX ```powershell theme={null} Get-MgExtensionAttributeInfo [[-TargetObject] ] [-ExcludeBuiltIn] [-SkipUsageCount] [-SkipDynamicGroups] [-ForceNewToken] [-ExportToExcel] [-ExportPath ] ``` ## DESCRIPTION Returns one row per custom attribute available in the tenant, whether it carries a value or not, so the inventory is exhaustive. Two mechanisms are covered: * the 15 built-in extension attributes exposed through onPremisesExtensionAttributes (extensionAttribute1..15); * the directory extensions declared by an application, named extension\_\\_\. Custom security attributes are deliberately out of scope: they cannot be used in dynamic membership rules. Use Get-MgCustomSecurityAttributeInfo for those. For every attribute the function reports whether it is populated, how many objects carry a value, and which dynamic groups reference it. It also flags the two situations that are hard to see from the portal: * Orphaned: the application that declared the directory extension no longer exists. The values remain in the directory and keep driving dynamic group membership, but the attribute can no longer be listed or corrected, and recreating the application does not help since the new AppId differs. * Referenced but empty: a dynamic group rule points at an attribute no object carries, so the group stays empty. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-MgExtensionAttributeInfo ``` Returns every built-in extension attribute and every directory extension, with their usage and their status. ### EXAMPLE 2 ```powershell theme={null} Get-MgExtensionAttributeInfo -TargetObject User, Group, Device ``` Counts the objects carrying a value on users, groups and devices instead of users only. ### EXAMPLE 3 ```powershell theme={null} Get-MgExtensionAttributeInfo -SkipUsageCount ``` Lists the attributes without counting values. Fast inventory on a large tenant. ### EXAMPLE 4 ```powershell theme={null} Get-MgExtensionAttributeInfo -ExportToExcel ``` Exports the inventory to an Excel file in the user's profile directory. ## PARAMETERS ### -ExcludeBuiltIn Leaves the 15 built-in extension attributes out of the inventory and reports directory extensions only. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath Optional output directory for the Excel export. Defaults to the user profile. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel Exports the result to an Excel file in the user's profile directory instead of returning it. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ForceNewToken Forces a new token to be requested from Microsoft Graph. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -SkipDynamicGroups Skips reading the dynamic group membership rules, so the DynamicGroups columns are left empty. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -SkipUsageCount Skips counting the objects carrying a value. The count is one Graph query per attribute and per object type, which is the slow part of the scan on a large tenant. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -TargetObject Object types to count values on. Valid values: User, Group, Device. Default is User only. Adding Device also counts the built-in extension attributes on devices, which carry them under a different property name and can be addressed by a device membership rule. ```yaml theme={null} Type: System.String[] DefaultValue: "@('User')" SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES Required Microsoft Graph permissions: * Application.Read.All * Directory.Read.All * Group.Read.All * User.Read.All The value counts use advanced queries (\$count with ConsistencyLevel eventual). When Graph refuses a filter on a given attribute, the count is left null and the reason is reported in the CountError column rather than failing the whole scan. A count that failed on one object type is never reported as a partial total: an attribute counted at zero on users and unreadable on devices is left Unknown rather than offered for cleanup. Definitions come from getAvailableExtensionProperties rather than from a walk of the applications collection. That is the only supported way to see an extension whose declaring application has been deleted, since Graph exposes no extensionProperties navigation on the recycle bin. Dynamic group rules are matched on both the user. and device. prefixes: extension attributes and directory extensions can be addressed either way depending on the type of group. ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-MgExtensionAttributeInfo](https://ps365.clidsys.com/docs/commands/Get-MgExtensionAttributeInfo) # Get-MgExternalUser Source: https://ps365.clidsys.com/docs/commands/Get-MgExternalUser Lists external users in Microsoft Entra ID based on their identities and invitation trace, not on userType. # Get-MgExternalUser ## SYNOPSIS Lists external users in Microsoft Entra ID based on their identities and invitation trace, not on userType. ## SYNTAX ```powershell theme={null} Get-MgExternalUser [[-Issuer] ] [-UserType ] [-IncludeSignInActivity] [-ForceNewToken] [-ExportToExcel] [-ExportPath ] ``` ## DESCRIPTION Most scripts identify external users with userType -eq 'Guest'. This is unreliable: users onboarded through cross-tenant synchronization, or guests converted to members, keep userType 'Member' while still being backed by an account from another directory. Get-MgExternalUser returns every account that is external by any of these criteria: * it holds at least one identity with signInType 'federated' (the account authenticates elsewhere) * it was created through an invitation (creationType 'Invitation') * it carries an invitation state (externalUserState) * its userPrincipalName contains the #EXT# pattern * its userType is 'Guest' The invitation state is deliberately NOT part of the detection: a guest who never redeemed its invitation is reported like any other external account. Each result is classified through the AuthSource property, which tells whether the account relies on its own identity provider or exists only thanks to this tenant: * ExternalTenant : issuer ExternalAzureAD - account from another Microsoft Entra ID tenant (B2B / cross-tenant sync) * MicrosoftAccount : issuer MSA - personal Microsoft account * SocialIdP : google.com, facebook.com, ... * social identity provider * ExternalIdP : issuer is a third-party domain - direct federation (SAML / WS-Fed) * LocalOTP : issuer 'mail' or one of this tenant's own domains - email one-time passcode, the account has NO external identity provider and depends entirely on this tenant * PendingRedemption : no federated identity yet - the invitation was never redeemed, so Entra ID has not determined which identity provider the account will use * Other : anything else Accounts with their own identity provider are ExternalTenant, MicrosoftAccount, SocialIdP and ExternalIdP. Accounts depending on this tenant are LocalOTP. PendingRedemption is undetermined until the invitation is redeemed. Filtering is done client-side because Microsoft Graph does not support server-side filtering on identities/signInType. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-MgExternalUser ``` Returns every external account of the tenant, whatever its issuer, userType and invitation state. ### EXAMPLE 2 ```powershell theme={null} Get-MgExternalUser | Where-Object { $_.AuthSource -eq 'LocalOTP' } ``` Returns the external accounts that have no external identity provider and exist only through this tenant (email one-time passcode). ### EXAMPLE 3 ```powershell theme={null} Get-MgExternalUser | Where-Object { $_.AuthSource -eq 'PendingRedemption' } ``` Returns the invited accounts that never redeemed their invitation. ### EXAMPLE 4 ```powershell theme={null} Get-MgExternalUser -Issuer 'ExternalAzureAD' -UserType Member ``` Returns external users from another tenant that are NOT flagged as guests, which is the typical footprint of cross-tenant synchronization. ### EXAMPLE 5 ```powershell theme={null} Get-MgExternalUser -IncludeSignInActivity | Where-Object { $_.DaysSinceLastSignIn -gt 90 } ``` Returns external users that have not signed in interactively for more than 90 days. ### EXAMPLE 6 ```powershell theme={null} Get-MgExternalUser -ExportToExcel ``` Exports the external users report to an Excel file in the user's profile directory. ## PARAMETERS ### -ExportPath (Optional) Output directory for the Excel export. Defaults to the user profile. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel (Optional) If specified, exports the results to an Excel file in the user's profile directory. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ForceNewToken Switch parameter to force getting a new token from Microsoft Graph. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IncludeSignInActivity (Optional) Adds the last sign-in information (interactive, non-interactive and last successful sign-in) plus the number of days since the last interactive sign-in. Requires the AuditLog.Read.All permission and a Microsoft Entra ID P1 or P2 license. When the tenant does not meet those requirements, the report falls back to the standard properties and a warning is displayed. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Issuer (Optional) Restricts the results to one or more identity issuers (for example 'ExternalAzureAD'). Because the filter applies to the federated identities, accounts classified PendingRedemption are excluded when this parameter is used: they do not carry an issuer yet. When omitted, every external account is returned whatever its issuer or invitation state. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -UserType (Optional) Restricts the results to a given userType. Valid values: All, Member, Guest. Default is All. Use 'Member' to surface external accounts that are NOT flagged as guests - typically cross-tenant synchronized users, which a userType-based script would miss. ```yaml theme={null} Type: System.String DefaultValue: All SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ### System.Collections.Generic.List\[PSCustomObject] *Not documented.* ## NOTES OUTPUT PROPERTIES Identity : DisplayName, UserPrincipalName, Mail, ExternalDomain ExternalDomain is the domain the account really belongs to, derived from the UPN (#EXT# pattern) or from the mail attribute. Origin : UserType, CreationType, AuthSource, Issuer, SignInType, IssuerAssignedId Issuer, SignInType and IssuerAssignedId come from the federated identities and are empty for PendingRedemption accounts. IssuerAssignedId is the identifier assigned by the issuer (typically the email address for social or OTP accounts). It is usually empty for ExternalAzureAD. Account state : AccountEnabled, InvitationState, InvitationStateChangeDateTime InvitationState is the Graph 'externalUserState' property: PendingAcceptance until the invitee redeems the invitation, then Accepted. It stays empty for accounts that were never invited (cross-tenant sync, direct creation). Sign-in activity: LastSignInDateTime, LastNonInteractiveSignInDateTime, LastSuccessfulSignInDateTime, DaysSinceLastSignIn (only with -IncludeSignInActivity) Metadata : CompanyName, CreatedDateTime, OnPremisesSyncEnabled, Id Required Microsoft Graph permissions: * User.Read.All * Domain.Read.All (to recognize an issuer that is one of this tenant's own domains) * AuditLog.Read.All (only with -IncludeSignInActivity) An external account that redeemed its invitation carries two identities: one with signInType 'userPrincipalName' issued by this tenant, and one with signInType 'federated' issued by its identity provider. Only the federated ones drive the AuthSource classification. With -IncludeSignInActivity the page size is capped at 120 users per request: Microsoft Graph enforces this limit when signInActivity is part of the \$select clause. The report is therefore slower on large tenants. ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-MgExternalUser](https://ps365.clidsys.com/docs/commands/Get-MgExternalUser) # Get-MgGroupOwnerInfo Source: https://ps365.clidsys.com/docs/commands/Get-MgGroupOwnerInfo Retrieves the owners of all or a specific Entra ID group. # Get-MgGroupOwnerInfo ## SYNOPSIS Retrieves the owners of all or a specific Entra ID group. ## SYNTAX ```powershell theme={null} Get-MgGroupOwnerInfo [[-GroupId] ] [[-DisplayName] ] [[-ExportPath] ] [-ExportToExcel] ``` ## DESCRIPTION The Get-MgGroupOwnerInfo function queries Microsoft Entra ID via the Microsoft Graph API to return the owners of each group. Results can be filtered by a specific group ID or display name, and are exported to Excel by default. Groups with no owners are included in the output with an empty owner list, which is useful for identifying groups that lack an accountable owner. Note: This function is named Get-MgGroupOwnerInfo to avoid conflict with the built-in Microsoft Graph PowerShell cmdlet Get-MgGroupOwner. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-MgGroupOwnerInfo ``` Retrieves the owners for all Entra ID groups and outputs them to the console. ### EXAMPLE 2 ```powershell theme={null} Get-MgGroupOwnerInfo -ExportToExcel ``` Retrieves the owners of all groups and exports the results to an Excel file. ### EXAMPLE 3 ```powershell theme={null} Get-MgGroupOwnerInfo -GroupId 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' ``` Retrieves owners for a specific group by its object ID and exports to Excel. ### EXAMPLE 4 ```powershell theme={null} Get-MgGroupOwnerInfo -DisplayName 'Marketing Team' ``` Retrieves owners for the group named 'Marketing Team' and outputs to the console only. ## PARAMETERS ### -DisplayName Optional. Filter groups by display name (exact match). Use with GroupId to narrow the scope. If omitted, all groups are processed. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 1 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 2 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel When specified, exports the results to an Excel file in the user's profile directory. Requires the ImportExcel module. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -GroupId Optional. The unique object ID of a specific Entra ID group to retrieve owners for. If omitted, all groups are processed. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: - Identity ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES Requires Connect-MgGraph with scopes: 'Group.Read.All', 'User.Read.All' ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-MgGroupOwnerInfo](https://ps365.clidsys.com/docs/commands/Get-MgGroupOwnerInfo) # Get-MgLAPSPassword Source: https://ps365.clidsys.com/docs/commands/Get-MgLAPSPassword Retrieves the LAPS password for a Microsoft Entra ID device. # Get-MgLAPSPassword ## SYNOPSIS Retrieves the LAPS password for a Microsoft Entra ID device. ## SYNTAX ### Default (Default) ```powershell theme={null} Get-MgLAPSPassword [-DeviceName ] [-DeviceID ] [-ShowPassword] [-IncludeHistory] [-RunFromAzureAutomation] ``` ### KeyVault ```powershell theme={null} Get-MgLAPSPassword -BackupToKeyVault -KeyVaultName [-DeviceName ] [-DeviceID ] [-ShowPassword] [-IncludeHistory] [-RunFromAzureAutomation] ``` ## DESCRIPTION Gets the Windows Local Administrator Password Solution (LAPS) password for one or all devices in Microsoft Entra ID (formerly Azure AD). By default, only metadata is returned (no password). Use -ShowPassword to retrieve the password in plain text. Passwords can optionally be backed up to an Azure Key Vault. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-MgLAPSPassword ``` Retrieves metadata (no password) for all devices with LAPS configured. ### EXAMPLE 2 ```powershell theme={null} Get-MgLAPSPassword -DeviceName "DESKTOP-ABC123" ``` Retrieves metadata (no password) for the device with the specified display name. ### EXAMPLE 3 ```powershell theme={null} Get-MgLAPSPassword -DeviceID "12345678-1234-1234-1234-123456789012" ``` Retrieves metadata (no password) for the specified device. ### EXAMPLE 4 ```powershell theme={null} Get-MgLAPSPassword -ShowPassword ``` Retrieves the current LAPS password in plain text for all devices. ### EXAMPLE 5 ```powershell theme={null} Get-MgLAPSPassword -DeviceID "12345678-1234-1234-1234-123456789012" -ShowPassword ``` Retrieves the current LAPS password in plain text for the specified device. ### EXAMPLE 6 ```powershell theme={null} Get-MgLAPSPassword -DeviceID "12345678-1234-1234-1234-123456789012" -ShowPassword -IncludeHistory ``` Retrieves the current and historical LAPS passwords for the specified device. The IsCurrent property indicates which entry is the active password. ### EXAMPLE 7 ```powershell theme={null} Get-MgLAPSPassword -BackupToKeyVault -KeyVaultName "MyLAPSVault" ``` Backs up LAPS passwords for all devices to Azure Key Vault. ### EXAMPLE 8 ```powershell theme={null} Get-MgLAPSPassword -DeviceID "12345678-1234-1234-1234-123456789012" -BackupToKeyVault -KeyVaultName "MyLAPSVault" ``` Backs up the LAPS password for the specified device to Azure Key Vault. ### EXAMPLE 9 ```powershell theme={null} Get-MgLAPSPassword -RunFromAzureAutomation -BackupToKeyVault -KeyVaultName "MyLAPSVault" ``` Backs up LAPS passwords for all devices using managed identity authentication. Suitable for Azure Automation runbooks. ## PARAMETERS ### -BackupToKeyVault Enable backup of LAPS passwords to Azure Key Vault. Must be used together with -KeyVaultName. The secret name is the device name; the Content Type field contains the account name and backup date. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: KeyVault Position: Named IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -DeviceID Filter results to a specific device by its Entra ID (Azure AD) object ID. If not specified, retrieves LAPS passwords for all devices. Cannot be used together with DeviceName parameter. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -DeviceName Filter results to a specific device by its display name. Cannot be used together with DeviceID parameter. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IncludeHistory Include previous LAPS passwords in the output, in addition to the current one. Only applicable when -ShowPassword or -BackupToKeyVault is specified. Has no effect otherwise. The output includes an IsCurrent property to identify the active password. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -KeyVaultName Name of the Azure Key Vault to back up LAPS passwords to. Mandatory when -BackupToKeyVault is specified. Requires the Az.KeyVault module and appropriate permissions. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: KeyVault Position: Named IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -RunFromAzureAutomation Use managed identity authentication instead of interactive authentication. Suitable for Azure Automation runbooks, Azure Functions, or VMs with managed identity enabled. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ShowPassword Retrieve and display the LAPS password in plain text. By default, only metadata (expiration time, etc.) is returned. Use with caution, as this will expose the password in the console output. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES Requires the DeviceLocalCredential.Read.All and Device.Read.All permissions in Microsoft Entra ID. ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-MgLAPSPassword](https://ps365.clidsys.com/docs/commands/Get-MgLAPSPassword) # Get-MgRegisteredApp Source: https://ps365.clidsys.com/docs/commands/Get-MgRegisteredApp Get registered application in Microsoft Graph # Get-MgRegisteredApp ## SYNOPSIS Get registered application in Microsoft Graph ## SYNTAX ### All (Default) ```powershell theme={null} Get-MgRegisteredApp ``` ### ByAppId ```powershell theme={null} Get-MgRegisteredApp [[-ApplicationID] ] ``` ### ByObjectId ```powershell theme={null} Get-MgRegisteredApp [-ObjectID ] ``` ### ByDisplayName ```powershell theme={null} Get-MgRegisteredApp [-DisplayName ] ``` ## DESCRIPTION Retrieves registered applications from Microsoft Graph. If no ApplicationID, ObjectID, or DisplayName is provided, returns all applications with selected properties. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-MgRegisteredApp -ApplicationID "your-application-id" ``` This command retrieves the registered application with the specified Application ID (AppId). ### EXAMPLE 2 ```powershell theme={null} Get-MgRegisteredApp -ObjectID "xxx-xxx-xxx" ``` This command retrieves the registered application with the specified ObjectID. ### EXAMPLE 3 ```powershell theme={null} Get-MgRegisteredApp -DisplayName "My Application" ``` This command retrieves the registered application with the specified DisplayName. ### EXAMPLE 4 ```powershell theme={null} Get-MgRegisteredApp -DisplayName "Azure*" ``` This command retrieves all registered applications whose DisplayName starts with "Azure". ### EXAMPLE 5 ```powershell theme={null} Get-MgRegisteredApp -DisplayName "*Portal*" ``` This command retrieves all registered applications whose DisplayName contains "Portal". ### EXAMPLE 6 ```powershell theme={null} Get-MgRegisteredApp ``` This command retrieves all registered applications. ## PARAMETERS ### -ApplicationID The unique identifier (AppId) of the registered application to retrieve. If not provided, all applications are returned. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: ByAppId Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -DisplayName (Optional) Retrieves the application for a specific application by its DisplayName. Supports wildcards (\* and ?) for partial name matching (e.g. "Azure\*", "*Portal*"). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: ByDisplayName Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ObjectID (Optional) Retrieves the application for a specific application by its ObjectID. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: - Identity ParameterSets: - Name: ByObjectId Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES Same as the Microsoft Graph built-in function `Get-MgApplication` but with a simplified output. ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-MgRegisteredApp](https://ps365.clidsys.com/docs/commands/Get-MgRegisteredApp) # Get-MgRoleReport Source: https://ps365.clidsys.com/docs/commands/Get-MgRoleReport Reports on Microsoft Entra ID (Azure AD) roles # Get-MgRoleReport ## SYNOPSIS Reports on Microsoft Entra ID (Azure AD) roles ## SYNTAX ```powershell theme={null} Get-MgRoleReport [[-Identity] ] [[-PrincipalID] ] [[-PrincipalDisplayName] ] [[-Scope] ] [[-TierLevel] ] [-IncludeEmptyRoles] [-ExcludePIMEligibleAssignments] [-ForceNewToken] [-MaesterMode] [-ExportToExcel] ``` ## DESCRIPTION Reports all the Microsoft Entra ID (Azure AD) roles with their members, including PIM eligible assignments and last sign-in activity. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-MgRoleReport ``` Get all the roles with members, including PIM eligible assignments but without empty roles ### EXAMPLE 2 ```powershell theme={null} Get-MgRoleReport -Identity 'Global Administrator' ``` Returns only the assignments of the Global Administrator role (filter accepts both role name and roleDefinitionId). ### EXAMPLE 3 ```powershell theme={null} Get-MgRoleReport -PrincipalID 'alice@contoso.com' ``` Returns only the role assignments of [alice@contoso.com](mailto:alice@contoso.com) (direct or via group membership). ### EXAMPLE 4 ```powershell theme={null} Get-MgRoleReport -PrincipalID '11111111-2222-3333-4444-555555555555' ``` Returns only the role assignments for the principal matching this ObjectId or AppId. ### EXAMPLE 5 ```powershell theme={null} Get-MgRoleReport -PrincipalDisplayName 'Alice Doe' ``` Returns only the role assignments for the principal whose DisplayName is 'Alice Doe'. ### EXAMPLE 6 ```powershell theme={null} Get-MgRoleReport -Scope '/' ``` Returns only the role assignments at tenant scope. ### EXAMPLE 7 ```powershell theme={null} Get-MgRoleReport -TierLevel 0 ``` Returns only the assignments of Tier 0 (control plane) roles. Each row carries a RoleTier property. ### EXAMPLE 8 ```powershell theme={null} Get-MgRoleReport -IncludeEmptyRoles ``` Get all the roles, including the ones without members ### EXAMPLE 9 ```powershell theme={null} Get-MgRoleReport -ExcludePIMEligibleAssignments ``` Get all the roles with members (without empty roles), but without PIM eligible assignments ### EXAMPLE 10 ```powershell theme={null} Get-MgRoleReport | Export-CSV -NoTypeInformation "$(Get-Date -Format yyyyMMdd)_adminRoles.csv" -Encoding UTF8 ``` ## PARAMETERS ### -ExcludePIMEligibleAssignments Switch parameter to exclude PIM eligible assignments from the report. Default is \$false (includes them) ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel Switch parameter to export the report to an Excel file in the user's profile directory ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ForceNewToken Switch parameter to force getting a new token from Microsoft Graph ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Identity Filter the report on a specific role. Accepts the role display name (e.g. 'Global Administrator') or the role definition Id (GUID). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IncludeEmptyRoles Switch parameter to include empty roles in the report ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -MaesterMode Switch parameter to use with the Maester framework (internal process not presented here) ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -PrincipalDisplayName Filter the report on a specific principal display name (exact match, case-insensitive). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 2 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -PrincipalID Filter the report on a specific principal. Accepts the UPN (user), AppId (service principal) or ObjectId. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 1 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Scope Filter the report on the assignment scope (AssignedRoleScope / directoryScopeId). Examples: '/' (tenant-wide), '/administrativeUnits/\' (AU-scoped), or any resource scope. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 3 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -TierLevel Filter the report on a privileged role tier: '0' (control plane), '1' (service/workload admins) or '2' (lower-privilege / read-mostly). Tiering is based on Sean Metcalf's (PyroTek3) classification. Regardless of this filter, every row is always annotated with a RoleTier property (Tier0/Tier1/Tier2/Untiered). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 4 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ### The report is output to an array contained all the audit logs found. To export in a csv *Not documented.* ## NOTES [https://itpro-tips.com/get-the-office-365-admin-roles-and-track-the-changes/](https://itpro-tips.com/get-the-office-365-admin-roles-and-track-the-changes/) Written by Bastien Perez (Clidsys.com - ITPro-Tips.com) For more Office 365/Microsoft 365 tips and news, check out ITPro-Tips.com. ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-MgRoleReport](https://ps365.clidsys.com/docs/commands/Get-MgRoleReport) # Get-MgUserIdentitySummary Source: https://ps365.clidsys.com/docs/commands/Get-MgUserIdentitySummary Summarizes how every user of a Microsoft Entra ID tenant authenticates, internal and external alike. # Get-MgUserIdentitySummary ## SYNOPSIS Summarizes how every user of a Microsoft Entra ID tenant authenticates, internal and external alike. ## SYNTAX ```powershell theme={null} Get-MgUserIdentitySummary [[-ExportPath] ] [-ExternalOnly] [-ForceNewToken] [-ExportToExcel] ``` ## DESCRIPTION Returns one row per distinct combination of (SignInType, Issuer, UserType, CreationType, InvitationState, IsExternal) with the number of identities matching it. It gives a one-page picture of the authentication landscape of the tenant. The granularity is the identity, not the user. A cloud-only internal user carries a single identity ('userPrincipalName' issued by this tenant). An external account that redeemed its invitation carries two: the local 'userPrincipalName' one plus a 'federated' one issued by its identity provider. An account that never redeemed its invitation only carries the local one, which is exactly what this view makes visible. Because internal and external accounts can share the very same (SignInType, Issuer) pair, the IsExternal column tells them apart. It uses the same detection as Get-MgExternalUser, so both reports always agree. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-MgUserIdentitySummary | Format-Table -AutoSize ``` Displays the identity summary of the whole tenant as a table. Format-Table is needed because the objects carry more than four properties, which PowerShell would otherwise render as a list. ### EXAMPLE 2 ```powershell theme={null} Get-MgUserIdentitySummary -ExternalOnly | Format-Table -AutoSize ``` Same summary restricted to the external accounts. ### EXAMPLE 3 ```powershell theme={null} Get-MgUserIdentitySummary -ExportToExcel ``` Exports the identity summary to an Excel file in the user's profile directory. ## PARAMETERS ### -ExportPath (Optional) Output directory for the Excel export. Defaults to the user profile. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel (Optional) If specified, exports the results to an Excel file in the user's profile directory. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExternalOnly (Optional) Restricts the summary to external accounts. Without it, every user of the tenant is included, which is the point of this function. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ForceNewToken Switch parameter to force getting a new token from Microsoft Graph. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ### System.Collections.Generic.List\[PSCustomObject] *Not documented.* ## NOTES OUTPUT PROPERTIES * Count : number of identities matching the combination * SignInType : signInType of the identity ('userPrincipalName', 'federated', ...) '\' when Graph returned no identity at all for the account * Issuer : issuer of the identity (a tenant domain, ExternalAzureAD, MSA, mail, ...) * UserType : userType of the account holding the identity (Member or Guest) * CreationType : creationType of the account ('Invitation' when it comes from a B2B invitation) * InvitationState : Graph 'externalUserState' property (PendingAcceptance, Accepted, or empty) * IsExternal : whether the account holding the identity is external (see Get-MgExternalUser) Required Microsoft Graph permissions: * User.Read.All ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-MgUserIdentitySummary](https://ps365.clidsys.com/docs/commands/Get-MgUserIdentitySummary) # Get-MgUserPasswordInfo Source: https://ps365.clidsys.com/docs/commands/Get-MgUserPasswordInfo Retrieves and processes user password information from Microsoft Graph and get information about the user's password, such as the last password change date, on-premises sync status, and password policies. # Get-MgUserPasswordInfo ## SYNOPSIS Retrieves and processes user password information from Microsoft Graph and get information about the user's password, such as the last password change date, on-premises sync status, and password policies. ## SYNTAX ```powershell theme={null} Get-MgUserPasswordInfo [[-UserPrincipalName] ] [-OnlyDomainPasswordPolicies] [-OnlySyncedUsers] [-FilterByDomain ] [-IncludeGuestUsers] [-IncludeExchangeDetails] [-ExportToExcel] [-SimulatedMaxPasswordAgeDays ] [-OnlyUsersWithForceChangePasswordNextSignIn] ``` ## DESCRIPTION The Get-MgUserPasswordInfo script collects details such as the user's principal name, last password change date, on-premises sync status, and password policies. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-MgUserPasswordInfo ``` Retrieves password information for all users and outputs it (default behavior). ### EXAMPLE 2 ```powershell theme={null} Get-MgUserPasswordInfo -UserPrincipalName xxx@domain.com ``` Retrieves password information for the specified user and outputs it. ### EXAMPLE 3 ```powershell theme={null} Get-MgUserPasswordInfo -OnlyDomainPasswordPolicies ``` Retrieves password policies for all domains only. ### EXAMPLE 4 ```powershell theme={null} Get-MgUserPasswordInfo -FilterByDomain "contoso.com" ``` Retrieves password information for users in the contoso.com domain only. ### EXAMPLE 5 ```powershell theme={null} Get-MgUserPasswordInfo -SimulatedMaxPasswordAgeDays 180 ``` Retrieves password information for all users and simulates what would happen with a 180-day password expiration policy, showing both current and simulated expiration dates. ## PARAMETERS ### -ExportToExcel (Optional) If specified, exports the results to an Excel file in the user's profile directory. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -FilterByDomain Specifies a domain name to filter users. Only users from the specified domain will be retrieved (excluding guest users). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IncludeExchangeDetails Include Exchange Online mailbox details in the output, useful to exclude shared mailboxes and others. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IncludeGuestUsers *Not documented.* ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -OnlyDomainPasswordPolicies If specified, retrieves password policies for domains only, without retrieving individual user information. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -OnlySyncedUsers If specified, retrieves password information for synchronized users only (OnPremisesSyncEnabled = \$true). ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -OnlyUsersWithForceChangePasswordNextSignIn If specified, retrieves password information for users who have ForceChangePasswordNextSignIn set to true only. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -SimulatedMaxPasswordAgeDays An optional parameter to simulate password expiration based on a specified maximum password age in days. If provided, the function will calculate a simulated password expiration date and indicate whether the password would be expired based on this simulated age. ```yaml theme={null} Type: System.Int32 DefaultValue: 0 SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -UserPrincipalName Specifies the user principal name(s) of the user(s) for which to retrieve password information. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: - Identity ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES Ensure you have the necessary permissions and modules installed to run this script, such as the Microsoft Graph PowerShell module. The script assumes that the necessary authentication to Microsoft Graph has already been handled with the Connect-MgGraph function. Connect-MgGraph -Scopes 'User.Read.All', 'Domain.Read.All', 'OnPremDirectorySynchronization.Read.All', 'AuditLog.Read.All' Password policies for *cloud-only* users: IF `PasswordPolicies` is 'DisablePasswordExpiration': THEN password never expires ELSEIF `PasswordPolicies` is 'None' or $null: IF domain's `PasswordValidityPeriodInDays` is 2147483647 or $null: THEN password never expires ELSE: password expires based on the domain's `PasswordValidityPeriodInDays` ELSE: IF domain's `PasswordValidityPeriodInDays` is 2147483647 or \$null THEN password never expires ELSE password expires based on the domain's `PasswordValidityPeriodInDays` Password policies for *synchronized* users: IF `CloudPasswordPolicyForPasswordSyncedUsersEnabled` is enabled: IF `PasswordPolicies` is 'None' or \$null: THEN password expires based on the domain's `PasswordValidityPeriodInDays` (same as cloud-only users above) ELSEIF `PasswordPolicies` is 'DisablePasswordExpiration': THEN password never expires ELSE: THEN password expires based on the domain's `PasswordValidityPeriodInDays` (same as cloud-only users above) ELSE (CloudPasswordPolicyForPasswordSyncedUsersEnabled is disabled): THEN password never expires Side note : When we manually want to set Password Policies to follow domain policies, we need to set PasswordPolicies 'None' via Microsoft Graph API because \$null is not accepted. ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-MgUserPasswordInfo](https://ps365.clidsys.com/docs/commands/Get-MgUserPasswordInfo) # Get-MgUserProvisioningError Source: https://ps365.clidsys.com/docs/commands/Get-MgUserProvisioningError Lists the users carrying provisioning errors in Microsoft Entra ID. # Get-MgUserProvisioningError ## SYNOPSIS Lists the users carrying provisioning errors in Microsoft Entra ID. ## SYNTAX ```powershell theme={null} Get-MgUserProvisioningError [[-Identity] ] [-ErrorSource ] [-IncludeResolved] [-ForceNewToken] [-ExportToExcel] ``` ## DESCRIPTION Scans the tenant (or a single user) for the two kinds of provisioning errors exposed on the user object by Microsoft Graph: * serviceProvisioningErrors: errors raised by a downstream Microsoft 365 service (typically Exchange Online) when provisioning the user. The error detail is an XML payload, parsed to surface the service name, the error code and the description. * onPremisesProvisioningErrors: synchronization errors coming from Entra Connect, typically an attribute conflict (AttributeValueMustBeUnique on proxyAddresses or userPrincipalName). Microsoft Graph does not support server-side filtering on these properties, so the whole user list is retrieved and filtered client-side. One result row per error: a user carrying several errors produces several rows. Resolved service provisioning errors are excluded by default (Graph keeps them with isResolved = true); use -IncludeResolved to see them. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-MgUserProvisioningError ``` Returns every active provisioning error of the tenant, one row per error. ### EXAMPLE 2 ```powershell theme={null} Get-MgUserProvisioningError -Identity 'user@contoso.com' ``` Returns the provisioning errors of a single user. ### EXAMPLE 3 ```powershell theme={null} Get-MgUserProvisioningError -ErrorSource OnPremisesSync ``` Returns only the Entra Connect synchronization errors (attribute conflicts). ### EXAMPLE 4 ```powershell theme={null} Get-MgUserProvisioningError -IncludeResolved ``` Also returns the service provisioning errors already resolved. ### EXAMPLE 5 ```powershell theme={null} Get-MgUserProvisioningError -ExportToExcel ``` Exports the provisioning errors report to an Excel file in the user's profile directory. ## PARAMETERS ### -ErrorSource (Optional) Restricts the results to one error source. Valid values: All, ServiceProvisioning, OnPremisesSync. Default is All. ```yaml theme={null} Type: System.String DefaultValue: All SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel (Optional) If specified, exports the results to an Excel file in the user's profile directory. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ForceNewToken Switch parameter to force getting a new token from Microsoft Graph. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Identity (Optional) UserPrincipalName or object id of a single user to check. When omitted, the whole tenant is scanned. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: true ValueFromPipelineByPropertyName: true ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IncludeResolved (Optional) Also returns the service provisioning errors flagged as resolved by Microsoft Graph. Ignored for on-premises errors, which Graph only keeps while they are active. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String *Not documented.* ## OUTPUTS ### System.Collections.Generic.List\[PSCustomObject] *Not documented.* ### System.Collections.Generic.List\`1\[\[System.Management.Automation.PSObject, System.Management.Automation, Version=7.5.0.500, Culture=neutral, PublicKeyToken=31bf3856ad364e35]] *Not documented.* ## NOTES OUTPUT PROPERTIES UserPrincipalName : the user carrying the error DisplayName : display name of the user ErrorSource : ServiceProvisioning (downstream service) or OnPremisesSync (Entra Connect) Service : service instance for service errors (e.g. exchange), empty for sync errors Category : error code for service errors, Graph category for sync errors (PropertyConflict for AttributeValueMustBeUnique) Property : attribute causing a sync error (e.g. ProxyAddresses), empty for service errors Description : parsed error description for service errors, conflicting value for sync errors IsResolved : True/False for service errors, empty for sync errors OccurredDateTime : when the error was recorded OnPremisesSyncEnabled : whether the user is synchronized from on-premises Id : object id of the user Required Microsoft Graph permissions: * User.Read.All Version history: 1.0 - Creation. Covers serviceProvisioningErrors (errorDetail XML parsed) and onPremisesProvisioningErrors, client-side filtering (no server-side filter support on these properties), one row per error. ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-MgUserProvisioningError](https://ps365.clidsys.com/docs/commands/Get-MgUserProvisioningError) # Get-MobileDeviceInfo Source: https://ps365.clidsys.com/docs/commands/Get-MobileDeviceInfo Retrieves detailed information about mobile devices associated with user mailboxes. # Get-MobileDeviceInfo ## SYNOPSIS Retrieves detailed information about mobile devices associated with user mailboxes. ## SYNTAX ```powershell theme={null} Get-MobileDeviceInfo [[-UserPrincipalName] ] ``` ## DESCRIPTION This script fetches mobile device details for specified user mailboxes or all mailboxes if none are specified. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-MobileDeviceInfo ``` Retrieves mobile device details for all user mailboxes. ### EXAMPLE 2 ```powershell theme={null} " ``` Retrieves mobile device details for the specified user. ## PARAMETERS ### -UserPrincipalName An array of User Principal Names (UPNs) to retrieve mobile device details for. If not provided, details for all mailboxes will be retrieved. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: true ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String\[] *Not documented.* ## OUTPUTS ## NOTES Author: Bastien Perez Works with both Exchange Online and on-premises Exchange environments and uses the appropriate cmdlets based on the environment. ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-MobileDeviceInfo](https://ps365.clidsys.com/docs/commands/Get-MobileDeviceInfo) # Get-NestedGroup Source: https://ps365.clidsys.com/docs/commands/Get-NestedGroup Lists all nested group dependencies (group-in-group) in Microsoft Entra ID. # Get-NestedGroup ## SYNOPSIS Lists all nested group dependencies (group-in-group) in Microsoft Entra ID. ## SYNTAX ```powershell theme={null} Get-NestedGroup [[-ExportPath] ] [-ExportToExcel] [-ExportToHtml] ``` ## DESCRIPTION The Get-NestedGroup function fetches all groups via the Microsoft Graph API, scans the members of each group to detect group-type members (nested groups), and outputs the dependencies. It supports optional export to Excel or CSV for further analysis. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-NestedGroup ``` Retrieves all nested group dependencies and outputs them to the console. ### EXAMPLE 2 ```powershell theme={null} Get-NestedGroup -ExportToExcel ``` Retrieves all nested group dependencies and exports the results to an Excel file. ### EXAMPLE 3 ```powershell theme={null} Get-NestedGroup -ExportToHtml ``` Retrieves all nested group dependencies and exports an interactive HTML graph to the user's profile directory. ## PARAMETERS ### -ExportPath Optional output directory for the Excel export (defaults to the user profile). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel When specified, exports the results to an Excel file in the user's profile directory. Requires the ImportExcel module. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToHtml When specified, exports the results to an interactive HTML graph file in the user's profile directory. The graph is rendered in the browser using D3.js (loaded from CDN). Nodes are color-coded by group type. Clicking a node zooms in and reveals its parent and child groups. The graph is frozen after stabilisation: individual nodes can be dragged without affecting the others. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ### System.Collections.Generic.List\[Object] *Not documented.* ## NOTES OUTPUT PROPERTIES Returns a collection of custom objects with the following properties: * MemberGroup: Display name of the nested (child) group * MemberGroupId: Unique identifier of the nested (child) group * MemberGroupType: Type of the nested group (Microsoft 365, Dynamic, Mail-enabled Security, Security, Distribution, Other) * ParentGroup: Display name of the parent group containing the nested group * ParentGroupId: Unique identifier of the parent group * ParentGroupType: Type of the parent group Requires Microsoft.Graph module: Connect-MgGraph -Scopes 'Group.Read.All' ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-NestedGroup](https://ps365.clidsys.com/docs/commands/Get-NestedGroup) # Get-PurviewRoleReport Source: https://ps365.clidsys.com/docs/commands/Get-PurviewRoleReport Reports on Purview RBAC roles and their effective membership, including groups expanded recursively. # Get-PurviewRoleReport ## SYNOPSIS Reports on Purview RBAC roles and their effective membership, including groups expanded recursively. ## SYNTAX ```powershell theme={null} Get-PurviewRoleReport [[-Identity] ] [[-PrincipalID] ] [[-PrincipalDisplayName] ] [-ShowGraph] ``` ## DESCRIPTION Produces a report of the membership of Purview RBAC role groups. By default, the report contains only the roles that have at least one member. When a role member is itself a group (distribution group, mail-enabled security group, dynamic distribution group, or a nested role group), its members are resolved recursively and included in the report with DirectMember set to \$false and MemberViaGroup set to the name of the group that is a direct member of the role. Circular group references are detected and skipped automatically. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-PurviewRoleReport ``` Retrieves the Purview RBAC role report, including recursive group expansion. ### EXAMPLE 2 ```powershell theme={null} Get-PurviewRoleReport -Identity 'Compliance Administrator' ``` Returns only the membership of the 'Compliance Administrator' role group. ### EXAMPLE 3 ```powershell theme={null} Get-PurviewRoleReport -PrincipalID 'alice@contoso.com' ``` Returns every Purview role assignment held by [alice@contoso.com](mailto:alice@contoso.com) (direct or via group membership). ### EXAMPLE 4 ```powershell theme={null} Get-PurviewRoleReport -PrincipalDisplayName 'Alice Doe' ``` Returns every Purview role assignment held by the user whose DisplayName is 'Alice Doe'. ### EXAMPLE 5 ```powershell theme={null} Get-PurviewRoleReport | Where-Object { $_.DirectMember -eq $false } | Format-Table Role, MemberName, MemberViaGroup ``` Lists all users/objects resolved through group membership, showing which group is a direct member of the role. ### EXAMPLE 6 ```powershell theme={null} Get-PurviewRoleReport | Export-Csv -NoTypeInformation "$(Get-Date -Format yyyyMMdd)_purviewRoles.csv" -Encoding UTF8 ``` Exports the full report (including group-expanded members) to a CSV file. ## PARAMETERS ### -Identity Filter the report on a specific role (matches the Role column, exact case-insensitive). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -PrincipalDisplayName Filter the report on a specific MemberDisplayName (exact, case-insensitive). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 2 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -PrincipalID Filter the report on a specific principal. Matches MemberName (alias), MemberPrimarySMTPAddres (UPN/SMTP), or MemberObjectID (ExternalDirectoryObjectId / GUID). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 1 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ShowGraph Reserved for future use. When specified, displays a graphical representation of the role membership. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ### \[System.Collections.Generic.List\[Object]] containing PSCustomObject rows with the following properties: Role *Not documented.* ## NOTES Requires ExchangeOnlineManagement module and an active Connect-IPPSSession session. ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-PurviewRoleReport](https://ps365.clidsys.com/docs/commands/Get-PurviewRoleReport) # Get-SPOSharingLinkReport Source: https://ps365.clidsys.com/docs/commands/Get-SPOSharingLinkReport Lists every sharing link of one or more SharePoint Online sites, one row per link, using PnP.PowerShell app-only. # Get-SPOSharingLinkReport ## SYNOPSIS Lists every sharing link of one or more SharePoint Online sites, one row per link, using PnP.PowerShell app-only. ## SYNTAX ```powershell theme={null} Get-SPOSharingLinkReport [-SiteUrl] -ClientId -Tenant [-CertificateThumbprint ] [-CertificatePath ] [-CertificatePassword ] [-CertificateBase64Encoded ] [-IncludeGraphDetails] [-LinkType ] [-ExpiredOnly] [-NeverExpiringOnly] [-ExpiringInDays ] [-ThrottleLimit ] [-ExportToExcel] [-ExportPath ] ``` ## DESCRIPTION Get-SPOSharingLinkReport is the file-level companion of Get-SPOSiteReport -IncludeSharingLinks: where the latter answers "which sites have an exposure worth looking at" with a per-site count, this function answers "which file is shared, with whom, until when, and through which URL" for the sites you point it at. It is deliberately not tenant-wide by default: the detail costs Microsoft Graph calls per shared item, so the intended workflow is to triage with Get-SPOSiteReport, then drill into the sites it flags. HOW THE SHARED ITEMS ARE FOUND A naive implementation walks every document library, loads HasUniqueRoleAssignments on every single item, and asks Graph for the links of the ones that have unique permissions. That is one round trip per file, which does not survive a real tenant. This function inverts the problem: SharePoint already materialises every sharing link as a hidden site group named 'SharingLinks.\.\.\', so a single Get-PnPGroup call per site yields the exact list of items that carry a link. Only those items are then resolved and queried. The cost is proportional to the number of shared items, not to the number of files in the site, which is usually several orders of magnitude smaller. Each candidate item is resolved from its unique ID through the REST endpoints /\_api/web/GetFileById and, if that returns nothing, /\_api/web/GetFolderById - an item is one or the other, and the group name does not say which. The links themselves are then read with Get-PnPFileSharingLink / Get-PnPFolderSharingLink, which is what provides the authoritative link type (the Graph 'scope' property), the expiration date, the password protection, the download block and the identities the link was shared with. The group name is used only as an index of what to look at, never as the source of truth for the link itself. TWO MODES, AND WHY THE DEFAULT AVOIDS GRAPH By default the function never calls Microsoft Graph. Everything it reports comes from the SharingLinks groups themselves: the shared item (resolved through SharePoint REST), the link type read from the group name, and - the part that matters most for an access audit - the people the link was shared with, who are literally the members of that group. This runs with the SharePoint Sites.FullControl.All permission the rest of the module already needs, and nothing more. IncludeGraphDetails adds what only Graph knows: the link URL, the expiration date, the password protection, the download block, the role granted, and the authoritative scope of a Flexible link. That costs one Graph call per shared item AND the Microsoft Graph APPLICATION permissions Files.Read.All and Sites.Read.All - which mean "read every file of the tenant, with no user behind the call". On a production tenant that is a decision worth making deliberately, not a checkbox: consider Sites.Selected instead, which scopes the app to the sites you explicitly grant it. WHAT THE DEFAULT MODE CANNOT TELL YOU A link type of 'Flexible' is reported as Flexible, never as 'SpecificPeople'. Flexible is the modern SharePoint link model where the scope is set per link, so the group name genuinely does not say whether such a link is restricted to named people or open to anyone holding it. Guessing here would be actively harmful: reporting a Flexible link as 'SpecificPeople' makes SharingLinksAnyoneCount read as zero on a site that may well have an anonymous link. When that distinction matters, IncludeGraphDetails is the only way to resolve it - the shared-with list of the default mode is often enough to conclude on its own. PERMISSIONS * Default mode: SharePoint (Office 365 SharePoint Online) Sites.FullControl.All application permission, the same one Get-SPOSiteReport uses. No Graph permission at all. * IncludeGraphDetails: the above, plus the Microsoft Graph APPLICATION permissions Files.Read.All and Sites.Read.All. These are a different Entra resource - consenting to the SharePoint one does not cover Graph. Without them every item fails at the last step with 'accessDenied 403' (Graph token present but insufficient) or 'Either scp or roles claim need to be present in the token' (no Graph permission on the certificate at all). After granting consent, allow a few minutes for propagation and reconnect: PnP caches the acquired token. Client secrets are not supported by SharePoint for app-only: a certificate is mandatory. Provide it through CertificateThumbprint (Windows certificate store), CertificatePath (.pfx file) or CertificateBase64Encoded (base64 string, handy for Azure Automation or a pipeline variable). Sites are processed in parallel (ForEach-Object -Parallel) with one PnP connection per site. Tune the concurrency with ThrottleLimit. PowerShell 7 is required. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-SPOSharingLinkReport -ClientId $clientId -Tenant 'contoso.onmicrosoft.com' -CertificateThumbprint $thumb -SiteUrl 'https://contoso.sharepoint.com/sites/marketing' ``` Lists every sharing link of a single site. ### EXAMPLE 2 ```powershell theme={null} Get-SPOSiteReport -ClientId $clientId -Tenant 'contoso.onmicrosoft.com' -CertificateThumbprint $thumb -IncludeSharingLinks | Where-Object { $_.SharingLinksAnyoneCount -gt 0 } | Get-SPOSharingLinkReport -ClientId $clientId -Tenant 'contoso.onmicrosoft.com' -CertificateThumbprint $thumb -LinkType Anyone ``` The intended workflow: triage the whole tenant with the cheap per-site counts, then get the file-level detail of the anonymous links only on the sites that actually have one. ### EXAMPLE 3 ```powershell theme={null} Get-SPOSharingLinkReport -ClientId $clientId -Tenant 'contoso.onmicrosoft.com' -CertificateThumbprint $thumb -SiteUrl $urls -NeverExpiringOnly -ExportToExcel ``` Exports every link that will never expire on the given sites to an Excel file in the user profile directory. ## PARAMETERS ### -CertificateBase64Encoded Base64-encoded certificate (with its private key) passed directly to Connect-PnPOnline. Provide exactly one of CertificateThumbprint, CertificatePath or CertificateBase64Encoded. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -CertificatePassword (Optional) SecureString password protecting the .pfx file passed to CertificatePath. ```yaml theme={null} Type: System.Security.SecureString DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -CertificatePath Path to a local .pfx certificate file. Use CertificatePassword when the file is protected. Provide exactly one of CertificateThumbprint, CertificatePath or CertificateBase64Encoded. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -CertificateThumbprint Thumbprint of the certificate located in the current user's Windows certificate store. Provide exactly one of CertificateThumbprint, CertificatePath or CertificateBase64Encoded. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ClientId (Mandatory) Application (client) ID of the Entra app registration used for the app-only connection. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExpiredOnly (Optional) Keeps only the links whose expiration date is in the past. Requires IncludeGraphDetails: expiration dates only exist in the Graph payload. Mutually exclusive with NeverExpiringOnly and ExpiringInDays. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExpiringInDays (Optional) Keeps only the links expiring within that many days from now, excluding those already expired. Requires IncludeGraphDetails. Mutually exclusive with ExpiredOnly and NeverExpiringOnly. ```yaml theme={null} Type: System.Int32 DefaultValue: 0 SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath (Optional) Output directory for the Excel export. Defaults to the user profile directory. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel (Optional) Exports the result to an .xlsx file instead of returning the objects to the pipeline. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IncludeGraphDetails (Optional) Re-reads every link through Microsoft Graph to add the link URL, the expiration date, the password protection, the download block, the granted role, and the real scope of a Flexible link. Requires the Microsoft Graph Files.Read.All and Sites.Read.All application permissions - see the PERMISSIONS section above before turning this on against a production tenant. Without it, the report carries LinkType/LinkTypeRaw, SharedWith, the item, and the SharingLinks group it came from. With it, those Graph columns are added and the type is resolved. Columns that were not collected are absent rather than empty, so an empty cell always means the data really is empty. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -LinkType (Optional) Restricts the output to one or more link types: Anyone (anonymous 'Anyone with the link'), Company (people in the organization), Flexible (modern link whose scope is only resolvable through Graph), SpecificPeople (requires IncludeGraphDetails), or Other for a type this function does not know about yet. Filtering happens after collection, so it does not make the run faster - it only makes the report shorter. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -NeverExpiringOnly (Optional) Keeps only the links that carry no expiration date at all. Requires IncludeGraphDetails. Mutually exclusive with ExpiredOnly and ExpiringInDays. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -SiteUrl (Mandatory) One or more site collection URLs to scan. Accepts pipeline input, by value or by the Url property, so the output of Get-SPOSiteReport can be piped straight in (its Url column binds to this parameter through its alias). ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: - Url ParameterSets: - Name: (All) Position: 0 IsRequired: true ValueFromPipeline: true ValueFromPipelineByPropertyName: true ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Tenant (Mandatory) Tenant domain name for the PnP connection, for example contoso.onmicrosoft.com. Used by Connect-PnPOnline (it expects the domain, not the tenant GUID). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ThrottleLimit (Optional) Number of sites processed concurrently. Defaults to 8. Lower it if SharePoint starts answering 429: past a certain rate, more concurrency means more throttling and a longer total run. ```yaml theme={null} Type: System.Int32 DefaultValue: 8 SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String\[] *Not documented.* ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-SPOSharingLinkReport](https://ps365.clidsys.com/docs/commands/Get-SPOSharingLinkReport) # Get-SPOSiteReport Source: https://ps365.clidsys.com/docs/commands/Get-SPOSiteReport Builds an inventory report of every SharePoint Online site of the tenant using PnP.PowerShell app-only. # Get-SPOSiteReport ## SYNOPSIS Builds an inventory report of every SharePoint Online site of the tenant using PnP.PowerShell app-only. ## SYNTAX ```powershell theme={null} Get-SPOSiteReport [-ClientId] [-Tenant] [[-CertificateThumbprint] ] [[-CertificatePath] ] [[-CertificatePassword] ] [[-CertificateBase64Encoded] ] [[-AdminUrl] ] [[-SiteUrl] ] [[-ExcludeGeo] ] [[-ThrottleLimit] ] [[-ExcelTemplatePath] ] [[-ExportPath] ] [-ExcludeOneDrive] [-OnlyOneDrive] [-IncludeAllDetails] [-IncludeSiteAdmins] [-IncludeSiteMembers] [-IncludeSiteVisitors] [-IncludeSharingLinks] [-IncludeSharingLinksDetails] [-RegionalSettingsDetails] [-M365GroupsDetails] [-ExportToExcel] [-ExportToHtml] [-MultiGeoStats] ``` ## DESCRIPTION Get-SPOSiteReport collects the configuration of the SharePoint Online sites: storage quota and usage, site collection administrators, site Owners/Members/Visitors, external sharing settings, sensitivity label, default sharing links, conditional access policy and hub site membership. The function connects with PnP.PowerShell in app-only mode (Entra app registration plus a certificate). This is the only reliable way to read site-level data (site collection administrators, site groups, regional settings) across every site of the tenant: the SharePoint Administrator role alone grants access to the admin center, not to the content of each site, so a delegated connection returns Access Denied on Get-PnPSiteCollectionAdmin. An app registration holding the SharePoint Sites.FullControl.All application permission bypasses the site collection admin requirement. That permission covers the personal OneDrive sites as well: they are ordinary site collections of the -my.sharepoint.com host, so they are enumerated and read exactly like any other site (use ExcludeOneDrive or OnlyOneDrive to filter them). The one documented exception is the list of site collection administrators of a OneDrive site, which stays invisible even under this permission: see SECONDARY ADMINISTRATORS ON ONEDRIVE SITES ARE NOT CAPTURED under the IncludeSiteAdmins parameter. Client secrets are not supported by SharePoint for app-only: a certificate is mandatory. Provide it through CertificateThumbprint (Windows certificate store), CertificatePath (.pfx file) or CertificateBase64Encoded (base64 string, handy for Azure Automation or a pipeline variable). The site-level collection runs in parallel (ForEach-Object -Parallel) with one PnP connection per site. Tune the concurrency with ThrottleLimit. PowerShell 7 is required. UNIFORM MEMBERS/OWNERS MODEL On a site connected to a Microsoft 365 group, the SharePoint site collection administrators and the Owners/Members/Visitors groups do not list individual users: they list a single claim placeholder that represents the whole group, of the form 'federateddirectoryclaimprovider|\\_o' (group Owners) or 'federateddirectoryclaimprovider|\' (group Members). Get-SPOSiteReport resolves these claims in a second pass, so the \*Resolved columns list actual users regardless of the site type (classic site, group-connected site, with or without a Microsoft Teams team). Two well-known non-user claims are also labelled for readability: the 'Everyone' claim and the 'Everyone except external users' claim. Any claim that cannot be resolved (deleted group, insufficient Graph permission) is reported as '\' and counted in the ClaimResolutionErrorCount summary at the end of the run. PROVENANCE OF EACH RESOLVED IDENTITY Every identity in a \*Resolved column is annotated so you can tell how it got its rights: * No annotation: the user is directly assigned to that SharePoint group/role (individual claim). * "\ (via M365 group '\' Owners)" or "... Members)": the user only has rights because they belong to that Microsoft 365 group, which itself was added to the SharePoint group/role as a whole. The same user can legitimately appear twice for the same site - once without annotation (direct) and once with it (also a member of a group that was added) - that is not a duplicate, it reflects two distinct sources of access. The group's display name is resolved once per distinct group for the whole run and falls back to its GUID if that lookup fails (deleted group, insufficient Graph permission). M365GROUPSDETAILS - APP-ONLY REQUIREMENT M365GroupsDetails is served entirely through the PnP app-only connection already opened by this function (Get-PnPMicrosoft365Group, Get-PnPTeamsTeam, Get-PnPTeamsChannel, Get-PnPTeamsUser, Get-PnPMicrosoft365GroupOwner, Get-PnPMicrosoft365GroupMember): no Exchange Online or Microsoft Teams session is needed. The Entra app registration must additionally hold the Microsoft Graph application permission Group.ReadWrite.All (or Group.Read.All for the read-only subset), on top of the SharePoint Sites.FullControl.All permission used for the rest of the report, both consented on the same certificate. The retrieval is scoped to what the run actually needs. Only a site carrying a GroupId can have a group behind it, so that list is computed first: when no site in scope is group-connected (a OneDrive-only run, or SiteUrl on a classic site) nothing is retrieved at all, and up to 25 group-connected sites are looked up one by one. The tenant-wide enumeration - which is expensive, since IncludeSiteUrl and IncludeOwners each add their own Graph work per group - only kicks in beyond that, where it becomes the cheaper option. MULTI-GEO TENANTS By default, every geo location of a Multi-Geo tenant is enumerated automatically (detected via Get-PnPTenantInstance): the function opens one additional PnP connection per satellite geo admin center purely to list its sites, merges every site into a single result set, and tags each one with a Geo column so its origin stays visible. The site-level detail collection and the Microsoft 365 group layer do not need any geo-specific handling: the former connects directly to each site's own URL (already geo-specific), and Microsoft 365 groups are Entra ID directory objects, not partitioned by geo. This only happens for the full tenant-wide report: SiteUrl (single site) and an explicitly supplied AdminUrl (one geo targeted on purpose) both stay single-geo, exactly as before. On a single-geo tenant this adds one harmless detection call and otherwise behaves exactly as before. Use ExcludeGeo to skip one or more geo locations entirely (for example one that is too noisy for the report at hand) - MultiGeoStats reflects the same exclusion automatically, since it aggregates the sites this enumeration already produced. Optional switches enrich the report: * IncludeSiteAdmins adds the full list of site collection administrators of each site (raw and resolved). * IncludeSiteMembers adds the site Owners and Members, resolved through the model described above. * IncludeSiteVisitors adds the site Visitors on top of IncludeSiteMembers. Kept separate because the Visitors group is often large (for example 'Everyone except external users') and less relevant to a rights audit than Owners/Members. * IncludeSharingLinks adds a per-site count of the existing sharing links, broken down by link type. * IncludeSharingLinksDetails drills into those links file by file, through Get-SPOSharingLinkReport. * RegionalSettingsDetails adds the time zone, hour format and locale of each site. * M365GroupsDetails adds the Microsoft 365 group and Microsoft Teams layer of the group-connected sites. Each of these switches literally adds its columns to the output objects: without the switch, the columns are absent, not empty. This is deliberate - an empty SiteAdmins column would read as "this site has no administrator", where the truth is "this was not collected". A column that is present but empty therefore always means the data really is empty (or could not be read, see the Status counters at the end of a run). ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Get-SPOSiteReport -ClientId $clientId -Tenant 'contoso.onmicrosoft.com' -CertificateThumbprint $thumb -MultiGeoStats ``` Returns, per Multi-Geo location (or a single row on a single-geo tenant), the total number of sites, the number of SharePoint sites and the number of OneDrive sites - without collecting any other detail. ### EXAMPLE 2 ```powershell theme={null} Get-SPOSiteReport -ClientId $clientId -Tenant 'contoso.onmicrosoft.com' -CertificateThumbprint $thumb -MultiGeoStats -ExportToExcel ``` Exports the per-geo site counts to an Excel file (worksheet 'SharePoint-MultiGeoStats') instead of returning the objects. ### EXAMPLE 3 ```powershell theme={null} Get-SPOSiteReport -ClientId $clientId -Tenant 'contoso.onmicrosoft.com' -CertificateThumbprint $thumb ``` Returns every SharePoint Online site of the tenant, including the personal OneDrive sites, using an app-only connection based on a certificate from the Windows certificate store. On a Multi-Geo tenant, this automatically covers every geo location and tags each site with its Geo column; on a single-geo tenant it behaves exactly like a normal full report. ### EXAMPLE 4 ```powershell theme={null} Get-SPOSiteReport -ClientId $clientId -Tenant 'contoso.onmicrosoft.com' -AdminUrl 'https://contosodeu-admin.sharepoint.com' -CertificateThumbprint $thumb ``` Restricts the report to a single Multi-Geo location by supplying its admin center URL explicitly - the automatic loop over every geo does not run in this case. ### EXAMPLE 5 ```powershell theme={null} Get-SPOSiteReport -ClientId $clientId -Tenant 'contoso.onmicrosoft.com' -CertificateThumbprint $thumb -ExcludeGeo 'CHE', 'TWN' ``` Enumerates every Multi-Geo location except CHE and TWN, still looping automatically over the rest. ### EXAMPLE 6 ```powershell theme={null} Get-SPOSiteReport -ClientId $clientId -Tenant 'contoso.onmicrosoft.com' -CertificateBase64Encoded $certB64 -ExcludeOneDrive -IncludeSiteAdmins -IncludeSiteMembers ``` Returns the SharePoint sites without the OneDrive ones and adds the site collection administrators plus the Owners and Members of each site, with individual users resolved even on group-connected sites. ### EXAMPLE 7 ```powershell theme={null} Get-SPOSiteReport -ClientId $clientId -Tenant 'contoso.onmicrosoft.com' -CertificatePath 'C:\Certs\app.pfx' -CertificatePassword $pwd -SiteUrl 'https://contoso.sharepoint.com/sites/marketing' -RegionalSettingsDetails ``` Returns a single site with its regional settings, using a .pfx certificate file. ### EXAMPLE 8 ```powershell theme={null} Get-SPOSiteReport -ClientId $clientId -Tenant 'contoso.onmicrosoft.com' -CertificateThumbprint $thumb -M365GroupsDetails -ExportToExcel ``` Adds the Microsoft 365 group and Microsoft Teams layer (Owners, Members, Guests, Teams metadata) using only the PnP app-only connection, and exports the results to an Excel file in the user profile directory. ### EXAMPLE 9 ```powershell theme={null} Get-SPOSiteReport -ClientId $clientId -Tenant 'contoso.onmicrosoft.com' -CertificateThumbprint $thumb -ExportToExcel -ExcelTemplatePath 'C:\Templates\SPOSiteReport-Template.xlsx' ``` Exports the results into a copy of the given template, keeping any other worksheet, formatting or logo already present in the template file. ### EXAMPLE 10 ```powershell theme={null} Get-SPOSiteReport -ClientId $clientId -Tenant 'contoso.onmicrosoft.com' -CertificateThumbprint $thumb -IncludeSharingLinks | Where-Object { $_.SharingLinksAnyoneCount -gt 0 } ``` Lists the sites holding at least one anonymous 'Anyone with the link' sharing link. Pipe the result to Get-SPOSharingLinkReport to get the file-level detail of those links on the sites that came out. ### EXAMPLE 11 ```powershell theme={null} $report = Get-SPOSiteReport -ClientId $clientId -Tenant 'contoso.onmicrosoft.com' -CertificateThumbprint $thumb -IncludeSharingLinksDetails $report[0].SharingLinksDetails | Format-Table ItemName, LinkType, SharedWith, ExpirationDateTime ``` Same triage, in one command: the counts decide which sites deserve the file-level pass, and each site object carries its own links in SharingLinksDetails. Add -ExportToExcel to get them as a second worksheet instead. ### EXAMPLE 12 ```powershell theme={null} Get-SPOSiteReport -ClientId $clientId -Tenant 'contoso.onmicrosoft.com' -CertificateThumbprint $thumb -ExcludeOneDrive -IncludeAllDetails -ExportToExcel ``` Turns on every detail switch (site admins, Owners/Members/Visitors, regional settings, Microsoft 365 group and Teams layer) in one go, without having to remember each switch name individually. ### EXAMPLE 13 ```powershell theme={null} Get-SPOSiteReport -ClientId $clientId -Tenant 'contoso.onmicrosoft.com' -CertificateThumbprint $thumb -ExcludeOneDrive -IncludeAllDetails -ExportToHtml ``` Generates a single self-contained HTML file with a collapsible rights tree per site (Admins, Owners, Members, Visitors, with identities inherited from a nested Microsoft 365 group shown separately), and opens it automatically. ## PARAMETERS ### -AdminUrl (Optional) URL of the SharePoint admin center, for example [https://contoso-admin.sharepoint.com](https://contoso-admin.sharepoint.com). When omitted, it is derived from the tenant name of the Tenant parameter. Provide it explicitly when Tenant is a vanity domain (for example contoso.com) rather than an onmicrosoft.com domain. On a Multi-Geo tenant, supplying AdminUrl explicitly restricts the whole report to that one geo: the automatic loop over every geo (see MULTI-GEO TENANTS above) only runs when AdminUrl is omitted and derived automatically from Tenant. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 6 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -CertificateBase64Encoded Base64-encoded certificate (with its private key) passed directly to Connect-PnPOnline. Provide exactly one of CertificateThumbprint, CertificatePath or CertificateBase64Encoded. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 5 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -CertificatePassword (Optional) SecureString password protecting the .pfx file passed to CertificatePath. ```yaml theme={null} Type: System.Security.SecureString DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 4 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -CertificatePath Path to a local .pfx certificate file. Use CertificatePassword when the file is protected. Provide exactly one of CertificateThumbprint, CertificatePath or CertificateBase64Encoded. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 3 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -CertificateThumbprint Thumbprint of the certificate located in the current user's Windows certificate store. Provide exactly one of CertificateThumbprint, CertificatePath or CertificateBase64Encoded. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 2 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ClientId (Mandatory) Application (client) ID of the Entra app registration used for the app-only connection. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExcelTemplatePath (Optional) Path to an existing .xlsx file used as a template for the Excel export. The template is copied to the destination path first, then the report data is written into a 'SharePoint-SiteReport' worksheet in that copy: any other worksheet, formatting or logo already present in the template is left untouched. Ignored when ExportToExcel is not specified. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 10 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExcludeGeo (Optional) On a Multi-Geo tenant, excludes one or more geo locations from the automatic enumeration (see MULTI-GEO TENANTS above), matched by their geo code (for example 'CHE', 'TWN' - case-insensitive). Handy when a specific geo has a lot of noise that is not relevant to the current report. Tab-completes against the official Microsoft 365 Geography (PreferredDataLocation) codes, but any value is accepted - the completer is a suggestion only, not a restriction, so a geo code not yet in that list still works. A geo name that does not match any detected location is ignored with a warning; excluding every detected geo returns nothing with a warning rather than silently producing an empty report. Has no effect when SiteUrl or an explicit AdminUrl already restrict the report to a single geo. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 8 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExcludeOneDrive (Optional) Excludes the personal OneDrive sites from the report. Cannot be combined with OnlyOneDrive. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportPath (Optional) Output directory for the Excel or HTML export. Defaults to the user profile. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 11 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToExcel (Optional) If specified, exports the results to an Excel file in the user's profile directory. Cannot be combined with ExportToHtml: only one export format is produced per call. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ExportToHtml (Optional) If specified, exports the results as a single self-contained HTML file (no external dependency, works offline) instead of returning the objects. Every site is rendered as a collapsible tree: Site Collection Admins / Owners / Members / Visitors, each showing the individual users resolved through the claim model above, with identities inherited from a nested Microsoft 365 group shown under their own collapsible sub-node (name and role of that group). A search box filters sites by title or URL, useful when the tenant has many sites. The file opens automatically once written. Cannot be combined with ExportToExcel: only one export format is produced per call. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IncludeAllDetails (Optional) Shorthand that turns on IncludeSiteAdmins, IncludeSiteMembers, IncludeSiteVisitors, IncludeSharingLinks, RegionalSettingsDetails and M365GroupsDetails all at once, so you don't have to remember and list each one individually. Does NOT affect ExcludeOneDrive/OnlyOneDrive: those are mutually exclusive site filters, not detail enrichment, and are left untouched. Individual switches passed alongside IncludeAllDetails have no additional effect (everything is already on). ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IncludeSharingLinks (Optional) Adds five columns counting the sharing links that currently exist on each site: SharingLinksAnyoneCount (anonymous 'Anyone with the link'), SharingLinksCompanyCount (people in the organization), SharingLinksFlexibleCount, SharingLinksOtherCount and SharingLinksTotalCount. Meant as a triage indicator: it answers "which sites have an exposure worth looking at", not "which file is shared with whom". SharingLinksFlexibleCount deserves a word: Flexible is the modern SharePoint link type, whose scope is set per link. The group name says the link exists, not whether it is restricted to named people or open to anyone holding it, and this report will not guess - counting Flexible links as 'specific people' would make SharingLinksAnyoneCount read as zero on a site that may well be exposing an anonymous link. A high SharingLinksFlexibleCount therefore means "worth resolving", which is what Get-SPOSharingLinkReport -IncludeGraphDetails does. SharePoint stores every sharing link as a hidden site group named 'SharingLinks.\.\.\', so this switch only costs one extra Get-PnPGroup call per site, and it reuses the app-only connection already opened for the site. The link type is derived from that group name (AnonymousEdit/AnonymousView, OrganizationEdit/OrganizationView, Flexible); since the naming is an internal SharePoint convention rather than a documented API, any unknown type is counted in SharingLinksOtherCount instead of being dropped. A non-zero SharingLinksOtherCount is worth investigating: it usually means a link type this function does not know about yet. What it deliberately does not provide: which file or folder is shared, and with whom. Use IncludeSharingLinksDetails, or Get-SPOSharingLinkReport directly, on the sites this report flags. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IncludeSharingLinksDetails (Optional) Drill-down of IncludeSharingLinks (which it turns on automatically): instead of stopping at the counts, each link is resolved down to the file or folder it points at and to the people it was shared with. The work is delegated to Get-SPOSharingLinkReport, which can also be called on its own. Only the sites whose counts came back non-zero are visited, so the pass is naturally limited to the sites that actually have something to show. It still opens one connection per site and resolves every shared item, which is why IncludeAllDetails does NOT turn this switch on - it has to be asked for explicitly. No Microsoft Graph permission is involved: the drill-down runs in the Graph-free mode of Get-SPOSharingLinkReport, where the shared-with list comes from the members of the SharingLinks group itself. The columns Graph alone can provide - link URL, expiration date, password protection, download block, and the resolved scope of a Flexible link - are therefore absent here. Call Get-SPOSharingLinkReport -IncludeGraphDetails yourself when you need them, after reading the permission trade-off documented in that function. Shape of the output: every site object receives a SharingLinksDetails property holding the collection of its own links (an empty collection when it has none, never $null), so the report stays one object per site and the drill-down is $site.SharingLinksDetails. With ExportToExcel, that nested property is dropped from the main worksheet - a cell cannot hold a collection - and the links are written to their own SharePoint-SharingLinks worksheet, one link per row. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IncludeSiteAdmins (Optional) Adds the full list of site collection administrators of each site, resolved with Get-PnPSiteCollectionAdmin, plus their resolved identities (SiteAdminsResolved). Requires the app-only connection described above. SECONDARY ADMINISTRATORS ON ONEDRIVE SITES ARE NOT CAPTURED SharePoint Administrators or Global Administrators cannot view the site collection administrators of a OneDrive site by default: they must be explicitly added as a site collection administrator on that specific OneDrive site to gain visibility into its admin list. Because of this restriction, Get-PnPSiteCollectionAdmin - which this switch relies on - does not pick up secondary administrators on OneDrive sites, even under the app-only certificate used by this function (see [https://github.com/pnp/powershell/discussions/4697](https://github.com/pnp/powershell/discussions/4697)). Expect SiteAdmins/SiteAdminsResolved to be incomplete or empty for OneDrive sites: this is not a bug in this function, it reflects what the connection is actually allowed to see. The 'My Site Secondary Admin' admin center page (reminded at the end of every run) remains the only reliable source for OneDrive secondary administrators. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IncludeSiteMembers (Optional) Adds the site Owners and Members groups of each site (Get-PnPGroup -AssociatedOwnerGroup / -AssociatedMemberGroup), raw and resolved through the claim resolution model described above. This is the reliable, site-type-agnostic replacement for auditing who effectively has rights on a site. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -IncludeSiteVisitors (Optional) Adds the site Visitors group of each site (Get-PnPGroup -AssociatedVisitorGroup), raw and resolved. Kept separate from IncludeSiteMembers because this group is often large and less relevant to a rights audit. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -M365GroupsDetails (Optional) Adds the Microsoft 365 group and Microsoft Teams details of the group-connected sites, served entirely through the PnP app-only connection (see the app-only requirement note above). No prior Exchange Online or Microsoft Teams session is needed. This switch significantly increases the execution time on large tenants. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -MultiGeoStats (Optional) Skips every detailed collection (site collection admins, Owners/Members/Visitors, regional settings, Microsoft 365 group and Teams layer) and returns only a per-geo site count: GeoName, IsDefaultGeo, AdminUrl, TotalSites, SharePointSites and OneDriveSites. Since the full report already enumerates every geo of a Multi-Geo tenant by default (see MULTI-GEO TENANTS in the description), this switch performs no connection or enumeration of its own: it simply groups the sites already merged above by their Geo tag and computes the same aggregates. It remains the fast, zero-per-site-connection mode - it still skips the detailed per-site collection entirely, it just no longer duplicates the site enumeration work. Combine with SiteUrl or an explicit AdminUrl to restrict the aggregation to that one site/geo, exactly like the full report does. ExportToExcel is honored (worksheet 'SharePoint-MultiGeoStats', ExcelTemplatePath applies too); ExportToHtml is ignored, since that export renders the detailed rights tree, which does not apply to a stats-only run. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -OnlyOneDrive (Optional) Restricts the report to the personal OneDrive sites. Cannot be combined with ExcludeOneDrive. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -RegionalSettingsDetails (Optional) Adds the regional settings of each site (time zone, hour format, locale), read with Get-PnPWeb. This switch significantly increases the execution time on large tenants. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -SiteUrl (Optional) Restricts the report to a single site collection URL. When omitted, every site of the tenant is processed. Always single-site/single-geo: the automatic Multi-Geo enumeration never applies when SiteUrl is used. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 7 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Tenant (Mandatory) Tenant domain name for the PnP connection, for example contoso.onmicrosoft.com. Used by Connect-PnPOnline (it expects the domain, not the tenant GUID). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 1 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ThrottleLimit (Optional) Maximum number of sites processed concurrently by the parallel site-level collection. Default is 8. ```yaml theme={null} Type: System.Int32 DefaultValue: 8 SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 9 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Get-SPOSiteReport](https://ps365.clidsys.com/docs/commands/Get-SPOSiteReport) # Install-M365Apps Source: https://ps365.clidsys.com/docs/commands/Install-M365Apps Installs Microsoft 365 Apps using the Office Deployment Tool. # Install-M365Apps ## SYNOPSIS Installs Microsoft 365 Apps using the Office Deployment Tool. ## SYNTAX ```powershell theme={null} Install-M365Apps [-ODTFolderPath] [-ConfigFilePath] ``` ## DESCRIPTION Uses the Office Deployment Tool to install Microsoft 365 Apps with a specified configuration file. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Install-M365Apps -ODTFolderPath '\\server\share\Office' -ConfigFilePath ".\Configuration-XX.xml" ``` Installs Microsoft 365 Apps from the specified network share using the provided configuration file. ### EXAMPLE 2 ```powershell theme={null} Install-M365Apps -ODTFolderPath 'C:\Custom-OfficeDeploymentTool' -ConfigFilePath 'C:\Configs\OfficeConfig.xml' ``` Installs Microsoft 365 Apps from the specified local folder using the provided configuration file. ## PARAMETERS ### -ConfigFilePath The path to the configuration XML file used for the installation. You can generate this file using the Office Customization Tool (OCT) at [https://config.office.com/](https://config.office.com/). Can be a relative or absolute path. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 1 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ODTFolderPath The network-accessible location containing the Microsoft 365 Apps source files and the Office Deployment Tool `setup.exe`. This can be a UNC path (e.g., \server\share\Office) or a local path (e.g., C:\OfficeSource). Can be a relative or absolute path. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES Ensure that the source path is accessible and that the configuration file is correctly formatted. The script requires administrative privileges to run. The Office Deployment Tool must be downloaded and extracted prior to running this script. The ODT folder must contains the ODT setup.exe file and the source files for installation (see `Invoke-M365AppsDownload.ps1`). ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Install-M365Apps](https://ps365.clidsys.com/docs/commands/Install-M365Apps) # Invoke-M365AppsDownload Source: https://ps365.clidsys.com/docs/commands/Invoke-M365AppsDownload Downloads the Microsoft 365 Apps binary using the Office Deployment Tool (ODT). # Invoke-M365AppsDownload ## SYNOPSIS Downloads the Microsoft 365 Apps binary using the Office Deployment Tool (ODT). ## SYNTAX ```powershell theme={null} Invoke-M365AppsDownload [-ConfigFilePath] ``` ## DESCRIPTION This script downloads the Office Deployment Tool from Microsoft's official site, extracts it, and uses a specified configuration XML file to download the Microsoft 365 Apps binary. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Invoke-M365AppsDownload -ConfigFilePath .\Configuration-XX.xml ``` Runs the script to download the Microsoft 365 Apps binary. ## PARAMETERS ### -ConfigFilePath The path to the configuration XML file used for the download. You can generate this file using the Office Customization Tool (OCT) at [https://config.office.com/](https://config.office.com/). Can be a relative or absolute path. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES Ensure that you have a valid configuration XML file in the ConfigFiles folder. ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Invoke-M365AppsDownload](https://ps365.clidsys.com/docs/commands/Invoke-M365AppsDownload) # Invoke-MgGraphBatchRequest Source: https://ps365.clidsys.com/docs/commands/Invoke-MgGraphBatchRequest Sends multiple Microsoft Graph requests in a single HTTP call using JSON batching. # Invoke-MgGraphBatchRequest ## SYNOPSIS Sends multiple Microsoft Graph requests in a single HTTP call using JSON batching. ## SYNTAX ```powershell theme={null} Invoke-MgGraphBatchRequest [-Requests] [[-GraphVersion] ] [[-MaxRetries] ] [[-Activity] ] ``` ## DESCRIPTION Wraps the Microsoft Graph \$batch endpoint ([https://learn.microsoft.com/en-us/graph/json-batching](https://learn.microsoft.com/en-us/graph/json-batching)) to combine up to 20 requests per HTTP call, drastically reducing round-trips for bulk read scenarios (e.g. one call per user). Requests are automatically chunked into batches of 20. Sub-requests throttled by Graph (HTTP 429) are retried automatically, honoring the Retry-After header announced by Graph (exponential backoff when absent). Returns a hashtable of responses indexed by the request id, so callers can match each response back to its request. Each response also includes CollectionResult with Identity, Status, Data, Error, TimestampUTC and Source. Each request is a hashtable with the keys expected by the \$batch endpoint: id (unique string), method (GET, POST...), url (relative to the Graph version, e.g. /users/\/authentication/methods) and optionally body and headers. Note: this function performs no permission check because the required scopes depend entirely on the URLs of the requests passed by the caller. The caller is responsible for connecting with the appropriate scopes beforehand. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} $requests = [System.Collections.Generic.List[hashtable]]::new() foreach ($user in $mgUsers) { $requests.Add(@{ id = "$($user.Id)"; method = 'GET'; url = "/users/$($user.Id)/authentication/methods" }) } $responses = Invoke-MgGraphBatchRequest -Requests $requests -Activity 'Getting authentication methods' ``` Retrieves the authentication methods of every user in $mgUsers with 20x fewer HTTP calls, then reads each result with $responses\["$($user.Id)"].body.value. ### EXAMPLE 2 ```powershell theme={null} $responses = Invoke-MgGraphBatchRequest -Requests $requests -GraphVersion 'v1.0' ``` Sends the requests against the v1.0 endpoint instead of beta. ## PARAMETERS ### -Activity Activity name displayed by Write-Progress while batches are being processed. ```yaml theme={null} Type: System.String DefaultValue: Processing Graph batch requests SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 3 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -GraphVersion Graph API version used for the \$batch endpoint: beta (default) or v1.0. ```yaml theme={null} Type: System.String DefaultValue: beta SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 1 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -MaxRetries Maximum number of retry rounds for throttled sub-requests (default 5). ```yaml theme={null} Type: System.Int32 DefaultValue: 5 SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 2 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Requests List of request hashtables to send. Each hashtable must contain at least id, method and url keys. ```yaml theme={null} Type: System.Collections.Generic.List`1[System.Collections.Hashtable] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ### System.Collections.Hashtable *Not documented.* ## NOTES \[0.1.0] - 2026-08-05 # Added * Initial version, promoted from the internal helper of Get-MgAuthNMethodInfo (PS365.Clidsys) ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Invoke-MgGraphBatchRequest](https://ps365.clidsys.com/docs/commands/Invoke-MgGraphBatchRequest) # New-ExTransportRuleFromJson Source: https://ps365.clidsys.com/docs/commands/New-ExTransportRuleFromJson Creates Exchange Online transport (mail flow) rules from one or more JSON definition files. # New-ExTransportRuleFromJson ## SYNOPSIS Creates Exchange Online transport (mail flow) rules from one or more JSON definition files. ## SYNTAX ```powershell theme={null} New-ExTransportRuleFromJson [-Path] [-Force] [-GenerateCmdlets] [-OutputFile ] [-WhatIf] [-Confirm] ``` ## DESCRIPTION This function reads JSON files describing Exchange Online transport rules and provisions them by splatting their content to New-TransportRule. The recommended layout is one JSON file per rule, which makes the rule set version-controllable and reproducible across tenants. Each JSON file must be a single object whose keys match New-TransportRule parameter names. If a rule with the same Name already exists in the tenant, the rule is skipped (use -Force to recreate it after deletion). Supports -WhatIf and -Confirm via SupportsShouldProcess. Use -GenerateCmdlets to emit the equivalent New-TransportRule cmdlets to a file instead of executing them. The function expects a connected ExchangeOnlineManagement session (Connect-ExchangeOnline). ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Connect-ExchangeOnline New-ExTransportRuleFromJson -Path "C:\eop-rules\Block-Outbound-OnMicrosoft.json" ``` Creates a single transport rule from the specified JSON file. ### EXAMPLE 2 ```powershell theme={null} New-ExTransportRuleFromJson -Path "C:\eop-rules" -WhatIf ``` Lists every transport rule that would be created from the JSON files in the directory without applying any change. ### EXAMPLE 3 ```powershell theme={null} New-ExTransportRuleFromJson -Path "C:\eop-rules" -Force ``` Creates every rule defined in the directory; pre-existing rules with the same Name are removed first. ### EXAMPLE 4 ```powershell theme={null} New-ExTransportRuleFromJson -Path "C:\eop-rules" -GenerateCmdlets -OutputFile "C:\temp\eop-rules.ps1" ``` Emits the equivalent New-TransportRule cmdlets to the specified file without executing them. Useful for review or for running the rule provisioning from another host. ## PARAMETERS ### -Confirm Prompts you for confirmation before running the cmdlet. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - cf ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Force If a rule with the same Name already exists, remove it before creating the new one. Without this switch, existing rules are skipped with a warning. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -GenerateCmdlets If specified, the function generates the New-TransportRule cmdlets and saves them to a file instead of executing them. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -OutputFile Path to the output file used by -GenerateCmdlets. If omitted while -GenerateCmdlets is set, defaults to a timestamped file in the user profile (cross-platform). Ignored unless -GenerateCmdlets is specified. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Path Path to a JSON file or to a directory containing one or more JSON files. When a directory is provided, every \*.json file in the directory is processed in alphabetical order. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: true ValueFromPipeline: true ValueFromPipelineByPropertyName: true ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -WhatIf Runs the command in a mode that only reports what would happen without performing the actions. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - wi ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String\[] *Not documented.* ## OUTPUTS ## NOTES Prerequisites: * PowerShell 5.1 or later. JSON content is converted to an ordered hashtable through a local helper to stay compatible with Windows PowerShell 5.1, which does not support ConvertFrom-Json -AsHashtable. * ExchangeOnlineManagement module installed and an active session opened with Connect-ExchangeOnline before running the function (unless -GenerateCmdlets is specified, which only emits the cmdlet text). * The signed-in account must hold a role with permission to manage mail flow rules, typically Exchange Administrator or a member of the Organization Management role group. ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/New-ExTransportRuleFromJson](https://ps365.clidsys.com/docs/commands/New-ExTransportRuleFromJson) # New-IntuneEnrollmentServicePrincipal Source: https://ps365.clidsys.com/docs/commands/New-IntuneEnrollmentServicePrincipal Creates the Microsoft Intune Enrollment Service Principal if it does not already exist. # New-IntuneEnrollmentServicePrincipal ## SYNOPSIS Creates the Microsoft Intune Enrollment Service Principal if it does not already exist. ## SYNTAX ```powershell theme={null} New-IntuneEnrollmentServicePrincipal ``` ## DESCRIPTION Creates the Microsoft Intune Enrollment Service Principal if it does not already exist in your Microsoft 365 tenant. The Microsoft Intune Enrollment Service Principal (Application ID: d4ebce55-015a-49b5-a083-c84d1797ae8c) is essential for properly configuring Conditional Access policies that target device enrollment scenarios ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} New-IntuneEnrollmentServicePrincipal ``` Creates the Microsoft Intune Enrollment Service Principal if it doesn't already exist in the tenant. ## PARAMETERS ## INPUTS ## OUTPUTS ## NOTES Scope(s) required: * Application.ReadWrite.All Microsoft documentation: [https://learn.microsoft.com/en-us/intune/intune-service/enrollment/multi-factor-authentication](https://learn.microsoft.com/en-us/intune/intune-service/enrollment/multi-factor-authentication) > The Microsoft Intune Enrollment cloud app isn't created automatically for new tenants. > To add the app for new tenants, a Microsoft Entra administrator must create a service principal object, with app ID d4ebce55-015a-49b5-a083-c84d1797ae8c, in PowerShell or Microsoft Graph. ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/New-IntuneEnrollmentServicePrincipal](https://ps365.clidsys.com/docs/commands/New-IntuneEnrollmentServicePrincipal) # Restart-MgSynchronizationJob Source: https://ps365.clidsys.com/docs/commands/Restart-MgSynchronizationJob Restarts synchronization jobs for one or more Entra ID applications. # Restart-MgSynchronizationJob ## SYNOPSIS Restarts synchronization jobs for one or more Entra ID applications. ## SYNTAX ### ByDisplayName (Default) ```powershell theme={null} Restart-MgSynchronizationJob -DisplayName [-ForceNewToken] [-RunFromAzureAutomation] [-ResetScope ] [-WhatIf] [-Confirm] ``` ### ByObjectId ```powershell theme={null} Restart-MgSynchronizationJob -ObjectID [-ForceNewToken] [-RunFromAzureAutomation] [-ResetScope ] [-WhatIf] [-Confirm] ``` ## DESCRIPTION Resolves the target service principal(s) by ObjectID or DisplayName (wildcards supported), retrieves all associated synchronization jobs, then restarts them via the Microsoft Graph API. Two authentication modes are available: * Interactive : prompts for sign-in with delegated permissions. * Managed Identity (RunFromAzureAutomation) : uses the managed identity assigned to the Azure resource (Automation Account, Function App, VM, etc.) - no credentials required. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Restart-MgSynchronizationJob -ObjectID 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' ``` Restarts all synchronization jobs for the application identified by its ObjectID. ### EXAMPLE 2 ```powershell theme={null} Restart-MgSynchronizationJob -DisplayName 'Workday to Entra' ``` Restarts all synchronization jobs for the application named exactly 'Workday to Entra'. ### EXAMPLE 3 ```powershell theme={null} Restart-MgSynchronizationJob -DisplayName '*Provisioning*' ``` Restarts all jobs for every application whose name contains 'Provisioning'. ### EXAMPLE 4 ```powershell theme={null} Restart-MgSynchronizationJob -DisplayName 'Workday to Entra' -RunFromAzureAutomation ``` Restarts all jobs for the matching application using Managed Identity authentication. Suitable for use in Azure Automation runbooks. ### EXAMPLE 5 ```powershell theme={null} Restart-MgSynchronizationJob -DisplayName 'Workday*' -ForceNewToken ``` Forces a new Graph token before resolving applications and restarting jobs. ### EXAMPLE 6 ```powershell theme={null} Restart-MgSynchronizationJob -DisplayName 'Workday to Entra' -ResetScope 'Escrows' ``` Retries only the objects currently in escrow (errored), without reprocessing the full directory. ### EXAMPLE 7 ```powershell theme={null} Restart-MgSynchronizationJob -DisplayName 'Workday to Entra' -ResetScope 'Watermark, Escrows' ``` Combines a full directory re-evaluation with an escrow retry. ### EXAMPLE 8 ```powershell theme={null} Restart-MgSynchronizationJob -DisplayName 'Workday to Entra' -ResetScope '' ``` Emulates the "Restart provisioning" button in the Entra portal (equivalent to QuarantineState + Watermark + Escrows with no explicit criteria body). ## PARAMETERS ### -Confirm Prompts you for confirmation before running the cmdlet. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - cf ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -DisplayName Display name of the target service principal(s). Supports wildcards (\* and ?): * "Workday\*" matches all apps whose name starts with "Workday" * "*Provisioning*" matches all apps whose name contains "Provisioning" * "Workday to Entra" exact match (no wildcard) Cannot be combined with -ObjectID. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: ByDisplayName Position: Named IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ForceNewToken Disconnects the existing Microsoft Graph session before connecting, forcing a fresh token to be acquired. Useful when the current token has expired or lacks required scopes. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ObjectID ObjectID (GUID) of the target service principal. Cannot be combined with -DisplayName. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: - Identity ParameterSets: - Name: ByObjectId Position: Named IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ResetScope Comma-separated combination of synchronizationJobRestartScope values controlling what is reset when the job restarts. Values can be combined (e.g. "Escrows, QuarantineState"). Supported values: `None` Starts a paused or quarantined provisioning job. DO NOT USE. Use the Start synchronizationJob API instead. `ConnectorDataStore` Clears the underlying cache for all users. DO NOT USE. Contact Microsoft Support for guidance. `Escrows` Provisioning failures are marked as escrows and retried. Clearing escrows will stop the service from retrying failures. `Watermark` Removing the watermark causes the service to re-evaluate all the users again, rather than just processing changes. `QuarantineState` Temporarily lifts the quarantine. `Full` Use this if you want all of the options (Escrows + Watermark + QuarantineState). `ForceDeletes` Forces the system to delete the pending deleted users when using the accidental deletions prevention feature and the deletion threshold is exceeded. An empty string ("") emulates the "Restart provisioning" button in the Microsoft Entra admin center. It is similar to setting resetScope to include QuarantineState, Watermark, and Escrows, and meets most customer needs. If you use `RunFromAzureAutomation`, you need to explicitly choose a reset scope, as the portal default relies on delegated permissions which are not available with Managed Identity authentication. Default : 'Escrows' (most common use case - retry errored objects without reprocessing the entire directory). Reference: [https://learn.microsoft.com/en-us/graph/api/resources/synchronization-synchronizationjobrestartcriteria](https://learn.microsoft.com/en-us/graph/api/resources/synchronization-synchronizationjobrestartcriteria) ```yaml theme={null} Type: System.String DefaultValue: Escrows SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -RunFromAzureAutomation Authenticates using the Managed Identity of the Azure resource. Use this switch when the function runs inside: * Azure Automation runbooks * Azure Functions * Azure VMs / Container Apps with a managed identity enabled When active, authentication uses the Managed Identity (Out-GridView is unavailable). ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -WhatIf Runs the command in a mode that only reports what would happen without performing the actions. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - wi ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES In the logs, you can filter on `configurationCategory`: `ProvisioningManagement` and `Activity Type`: `Enable/restart provisioning`. Required Microsoft Graph permissions: * Application.Read.All * Synchronization.ReadWrite.All Required PowerShell modules: * Microsoft.Graph.Authentication * Microsoft.Graph.Applications API version used: v1.0 In the log, you can configurationCategory: ProvisioningManagement and Activity Type: Enable/restart provisioning/ ## RELATED LINKS * [https://learn.microsoft.com/en-us/graph/api/synchronization-synchronizationjob-restart](https://learn.microsoft.com/en-us/graph/api/synchronization-synchronizationjob-restart) # Search-UnifiedAuditLogCustom Source: https://ps365.clidsys.com/docs/commands/Search-UnifiedAuditLogCustom Search-UnifiedAuditLogCustom is an enhanced wrapper around the native Search-UnifiedAuditLog cmdlet, providing additional features such as a user-friendly GUI for constructing search queries, simplified output formatting, and integration with the Microsoft 365 audit operations catalog. # Search-UnifiedAuditLogCustom ## SYNOPSIS Search-UnifiedAuditLogCustom is an enhanced wrapper around the native Search-UnifiedAuditLog cmdlet, providing additional features such as a user-friendly GUI for constructing search queries, simplified output formatting, and integration with the Microsoft 365 audit operations catalog. ## SYNTAX ```powershell theme={null} Search-UnifiedAuditLogCustom [[-StartDate] ] [[-EndDate] ] [[-Operations] ] [[-UserIds] ] [[-FreeText] ] [[-ResultSize] ] [[-ChunkDays] ] [-SimpleView] [-HelperGUI] ``` ## DESCRIPTION This function allows administrators and security professionals to perform more efficient and targeted searches of the Microsoft 365 Unified Audit Log. It includes a helper GUI that enables users to easily select operations from the official Microsoft Learn catalog, specify date ranges, user filters, and other parameters without needing to remember complex cmdlet syntax. The output can be returned in a simplified format that flattens nested JSON structures for easier analysis and export. This is particularly useful for security investigations, compliance audits, and general monitoring of activities across Microsoft 365 services. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Search-UnifiedAuditLogCustom -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -Operations "UserLoggedIn", "FileAccessed" -SimpleView ``` This example searches the Unified Audit Log for "UserLoggedIn" and "FileAccessed" operations that occurred in the last 7 days, and returns the results in a simplified format. ## PARAMETERS ### -ChunkDays Size (in days) of each sub-window used to split the StartDate/EndDate range. Defaults to 7. The function loops over the full range one chunk at a time and uses session pagination inside each chunk, which avoids the server-side 'Search duration too long' error encountered on very wide windows. Lower this value (e.g. 1 or 3) if a chunk itself returns the 'too long' error. ```yaml theme={null} Type: System.Int32 DefaultValue: 7 SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 6 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -EndDate The end date and time for the audit log search. If not specified, defaults to the current date and time. ```yaml theme={null} Type: System.DateTime DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 1 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -FreeText A free text string to search for within the audit log records. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 4 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -HelperGUI When specified, opens a graphical user interface to assist in constructing the search query with user-friendly controls and operation selection. The operations list is populated from the Microsoft Learn catalog of audit log activities, allowing users to easily find and select relevant operations for their search. Make sure to have access to the Microsoft Learn page for audit log activities to load the operations catalog successfully ([https://learn.microsoft.com/en-us/purview/audit-log-activities](https://learn.microsoft.com/en-us/purview/audit-log-activities)). ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Operations An array of operation names to filter the search. These can be selected from the helper GUI, which loads the catalog of operations from Microsoft Learn. Users can also enter raw cmdlet names (e.g., New-TransportRule) to filter by specific operations. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 2 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ResultSize The maximum number of results to return from the search. Defaults to 5000. ```yaml theme={null} Type: System.Int32 DefaultValue: 5000 SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 5 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -SimpleView When specified, the output will be processed to flatten nested JSON structures into a simpler format. This is ideal for exporting to CSV or performing quick analysis without dealing with complex nested properties. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: - Simple ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -StartDate The start date and time for the audit log search. If not specified, defaults to 24 hours ago. ```yaml theme={null} Type: System.DateTime DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -UserIds An array of user identifiers (e.g., email addresses) to filter the search results by specific users. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 3 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES ## RELATED LINKS *Not documented.* # Set-ExCalendarPermission Source: https://ps365.clidsys.com/docs/commands/Set-ExCalendarPermission Sets calendar folder permissions for a mailbox in Exchange Online. # Set-ExCalendarPermission ## SYNOPSIS Sets calendar folder permissions for a mailbox in Exchange Online. ## SYNTAX ### Identity (Default) ```powershell theme={null} Set-ExCalendarPermission [[-Identity] ] -AccessRights -DelegateUser [-WhatIf] [-Confirm] ``` ### AllMailboxes ```powershell theme={null} Set-ExCalendarPermission -AllMailboxes -AccessRights -DelegateUser [-WhatIf] [-Confirm] ``` ## DESCRIPTION Grants or updates calendar permissions for a delegate user on a target mailbox. The calendar folder is automatically resolved from the mailbox identity. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Set-ExCalendarPermission -Identity "john.doe@contoso.com" -AccessRights Reviewer -DelegateUser "jane.doe@contoso.com" ``` Grants read-only access to Jane on John's calendar. ### EXAMPLE 2 ```powershell theme={null} Set-ExCalendarPermission -Identity "john.doe@contoso.com" -AccessRights FreeBusyTimeOnly -DelegateUser "jane.doe@contoso.com" ``` Grants free/busy visibility only to Jane on John's calendar. ### EXAMPLE 3 ```powershell theme={null} Set-ExCalendarPermission -AllMailboxes -AccessRights Reviewer -DelegateUser "auditor@contoso.com" -WhatIf ``` Previews granting Reviewer access to the delegate on every mailbox calendar. ## PARAMETERS ### -AccessRights The permission level to grant to the delegate user. Accepted values: * None - The user has no permissions on the folder. * FreeBusyTimeOnly - The user can view only free/busy time within the calendar. * FreeBusyTimeAndSubjectAndLocation - The user can view free/busy time within the calendar and the subject and location of appointments. * Reviewer - The user can read all items in the folder. * Contributor - The user can create items in the folder. The contents of the folder do not appear. * NoneditingAuthor - The user can create and read all items in the folder, and delete only items that the user creates. * Author - The user can create and read all items in the folder, and edit and delete only items that the user creates. * PublishingAuthor - The user can create and read all items in the folder, edit and delete only items that the user creates, and create subfolders. * Editor - The user can create, read, edit and delete all items in the folder. * PublishingEditor - The user can create, read, edit, and delete all items in the folder, and create subfolders. * Owner - The user can create, read, edit, and delete all items in the folder, and create subfolders. The user is both folder owner and folder contact. * Custom - The user has custom access permissions on the folder. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -AllMailboxes Apply the calendar permission to all mailboxes in the organization. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: AllMailboxes Position: Named IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Confirm Prompts you for confirmation before running the cmdlet. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - cf ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -DelegateUser The user to whom the calendar permissions will be granted. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Identity The identity of one or more mailboxes whose calendar permissions will be modified (email address, username, or display name). ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: Identity Position: 0 IsRequired: false ValueFromPipeline: true ValueFromPipelineByPropertyName: true ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -WhatIf Runs the command in a mode that only reports what would happen without performing the actions. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - wi ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String\[] *Not documented.* ## OUTPUTS ## NOTES Requires the ExchangeOnlineManagement module and an active connection to Exchange Online. ## RELATED LINKS *Not documented.* # Set-ExMailboxMaxSize Source: https://ps365.clidsys.com/docs/commands/Set-ExMailboxMaxSize Set maximum mailbox size for specified mailboxes. # Set-ExMailboxMaxSize ## SYNOPSIS Set maximum mailbox size for specified mailboxes. ## SYNTAX ### Identity (Default) ```powershell theme={null} Set-ExMailboxMaxSize [[-Identity] ] [-GenerateCmdlets] [-OutputFile ] [-WhatIf] [-Confirm] ``` ### ByDomain ```powershell theme={null} Set-ExMailboxMaxSize -ByDomain [-GenerateCmdlets] [-OutputFile ] [-WhatIf] [-Confirm] ``` ### FromCSV ```powershell theme={null} Set-ExMailboxMaxSize -FromCSV [-GenerateCmdlets] [-OutputFile ] [-WhatIf] [-Confirm] ``` ### AllMailboxes ```powershell theme={null} Set-ExMailboxMaxSize -AllMailboxes [-GenerateCmdlets] [-OutputFile ] [-WhatIf] [-Confirm] ``` ## DESCRIPTION This function sets the maximum mailbox size (MaxReceiveSize and MaxSendSize) for Exchange Online mailboxes. It can target mailboxes by identity, by domain, from a CSV file, or all mailboxes in the organization. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Set-ExMailboxMaxSize -Identity "user@example.com" ``` Sets the maximum mailbox size for the specified mailbox. ### EXAMPLE 2 ```powershell theme={null} Set-ExMailboxMaxSize -ByDomain "example.com" ``` Sets the maximum mailbox size for all mailboxes in the specified domain. ### EXAMPLE 3 ```powershell theme={null} Set-ExMailboxMaxSize -AllMailboxes ``` Sets the maximum mailbox size for all mailboxes in the organization. ### EXAMPLE 4 ```powershell theme={null} Set-ExMailboxMaxSize -FromCSV "C:\path\to\file.csv" ``` Sets the maximum mailbox size for mailboxes listed in the specified CSV file. ### EXAMPLE 5 ```powershell theme={null} Set-ExMailboxMaxSize -ByDomain "example.com" -GenerateCmdlets -OutputFile "C:\path\to\commands.ps1" ``` Generates the Set-Mailbox cmdlets for all mailboxes in the specified domain and saves them to the specified file without executing them. ## PARAMETERS ### -AllMailboxes If specified, all mailboxes in the organization will be processed. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: AllMailboxes Position: Named IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ByDomain Filter mailboxes by domain name. All mailboxes with a primary SMTP address in this domain will be processed. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: ByDomain Position: Named IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Confirm Prompts you for confirmation before running the cmdlet. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - cf ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -FromCSV The path to a CSV file with a PrimarySmtpAddress column. All rows are validated and resolved before any change. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: FromCSV Position: Named IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -GenerateCmdlets If specified, the function will generate the cmdlets and save them to a file instead of executing them. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Identity The identity of the mailbox(es) to set the maximum size for. This can be an array of email addresses, usernames, or display names. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: Identity Position: 0 IsRequired: false ValueFromPipeline: true ValueFromPipelineByPropertyName: true ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -OutputFile The path to the output file where generated cmdlets will be saved. Default is a timestamped file in the current directory. ```yaml theme={null} Type: System.String DefaultValue: "\"$(Get-Date -Format 'yyyy-MM-dd_HHmmss')-SetExMailboxMaxSize-Commands.ps1\"" SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -WhatIf Runs the command in a mode that only reports what would happen without performing the actions. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - wi ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String\[] *Not documented.* ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Set-ExMailboxMaxSize](https://ps365.clidsys.com/docs/commands/Set-ExMailboxMaxSize) # Set-ExMailboxProtocol Source: https://ps365.clidsys.com/docs/commands/Set-ExMailboxProtocol Set Exchange mailbox protocol settings. # Set-ExMailboxProtocol ## SYNOPSIS Set Exchange mailbox protocol settings. ## SYNTAX ### Identity (Default) ```powershell theme={null} Set-ExMailboxProtocol [[-Identity] ] [-GenerateCmdlets] [-OutputFile ] [-ModernProtocolsOnly] [-ModernProtocolsAndEws] [-MAPIEnabled ] [-OWAEnabled ] [-PopEnabled ] [-ImapEnabled ] [-ActiveSyncEnabled ] [-EwsEnabled ] [-SmtpClientAuthenticationDisabled ] [-UniversalOutlookEnabled ] [-OutlookMobileEnabled ] [-WhatIf] [-Confirm] ``` ### ByDomain ```powershell theme={null} Set-ExMailboxProtocol -ByDomain [-GenerateCmdlets] [-OutputFile ] [-ModernProtocolsOnly] [-ModernProtocolsAndEws] [-MAPIEnabled ] [-OWAEnabled ] [-PopEnabled ] [-ImapEnabled ] [-ActiveSyncEnabled ] [-EwsEnabled ] [-SmtpClientAuthenticationDisabled ] [-UniversalOutlookEnabled ] [-OutlookMobileEnabled ] [-WhatIf] [-Confirm] ``` ### FromCSV ```powershell theme={null} Set-ExMailboxProtocol -FromCSV [-GenerateCmdlets] [-OutputFile ] [-ModernProtocolsOnly] [-ModernProtocolsAndEws] [-MAPIEnabled ] [-OWAEnabled ] [-PopEnabled ] [-ImapEnabled ] [-ActiveSyncEnabled ] [-EwsEnabled ] [-SmtpClientAuthenticationDisabled ] [-UniversalOutlookEnabled ] [-OutlookMobileEnabled ] [-WhatIf] [-Confirm] ``` ### AllMailboxes ```powershell theme={null} Set-ExMailboxProtocol -AllMailboxes [-GenerateCmdlets] [-OutputFile ] [-ModernProtocolsOnly] [-ModernProtocolsAndEws] [-MAPIEnabled ] [-OWAEnabled ] [-PopEnabled ] [-ImapEnabled ] [-ActiveSyncEnabled ] [-EwsEnabled ] [-SmtpClientAuthenticationDisabled ] [-UniversalOutlookEnabled ] [-OutlookMobileEnabled ] [-WhatIf] [-Confirm] ``` ## DESCRIPTION This function sets the protocol settings (MAPI, OWA, IMAP, POP, EWS, ActiveSync) for Exchange Online mailboxes. It can target mailboxes by identity, by domain, from a CSV file, or all mailboxes in the organization. It also allows enabling modern protocols only or modern protocols along with EWS. Additionally, it can configure SMTP Client Authentication settings at the mailbox level. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Set-ExMailboxProtocol -Identity "user@example.com" -ModernProtocolsOnly ``` Sets modern protocols only for the specified mailbox. ### EXAMPLE 2 ```powershell theme={null} Set-ExMailboxProtocol -ByDomain "example.com" -GenerateCmdlets -OutputFile "C:\path\to\commands.ps1" ``` Generates the Set-CasMailbox cmdlets for all mailboxes in the specified domain to enable modern protocols only and saves them to the specified file without executing them. ### EXAMPLE 3 ```powershell theme={null} Set-ExMailboxProtocol -FromCSV "C:\path\to\file.csv" ``` Sets protocol settings for mailboxes listed in the specified CSV file. ### EXAMPLE 4 ```powershell theme={null} Set-ExMailboxProtocol -AllMailboxes -ModernProtocolsAndEws ``` Sets modern protocols along with EWS for all mailboxes in the organization. ## PARAMETERS ### -ActiveSyncEnabled Set ActiveSync protocol enabled or disabled. ```yaml theme={null} Type: System.Boolean DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -AllMailboxes If specified, all mailboxes in the organization will be processed. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: AllMailboxes Position: Named IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ByDomain Filter mailboxes by domain name. All mailboxes with a primary SMTP address in this domain will be processed. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: ByDomain Position: Named IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Confirm Prompts you for confirmation before running the cmdlet. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - cf ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -EwsEnabled Set EWS protocol enabled or disabled. ```yaml theme={null} Type: System.Boolean DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -FromCSV The path to a CSV file containing mailbox identities to process. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: FromCSV Position: Named IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -GenerateCmdlets If specified, the function will generate the cmdlets and save them to a file instead of executing them. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Identity The identity of the mailbox(es) to set protocol settings for. This can be an array of email addresses, usernames, or display names. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: Identity Position: 0 IsRequired: false ValueFromPipeline: true ValueFromPipelineByPropertyName: true ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ImapEnabled Set IMAP protocol enabled or disabled. ```yaml theme={null} Type: System.Boolean DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -MAPIEnabled Set MAPI protocol enabled or disabled. ```yaml theme={null} Type: System.Boolean DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ModernProtocolsAndEws If specified, enables modern protocols (MAPI, OWA, Outlook Mobile) along with EWS, and disables legacy protocols (POP, IMAP, ActiveSync) along with disabling SMTP Client Authentication at the mailbox level. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ModernProtocolsOnly If specified, enables only modern protocols (MAPI, OWA, Outlook Mobile) and disables legacy protocols (POP, IMAP, ActiveSync, EWS) along with disabling SMTP Client Authentication at the mailbox level. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -OutlookMobileEnabled Set Outlook Mobile access enabled or disabled. ```yaml theme={null} Type: System.Boolean DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -OutputFile The path to the output file where generated cmdlets will be saved. Default is a timestamped file in the current directory. ```yaml theme={null} Type: System.String DefaultValue: "\"$(Get-Date -Format 'yyyy-MM-dd_HHmmss')-SetExMailboxProtocol_Commands.txt\"" SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -OWAEnabled Set OWA protocol enabled or disabled. ```yaml theme={null} Type: System.Boolean DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -PopEnabled Set POP protocol enabled or disabled. ```yaml theme={null} Type: System.Boolean DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -SmtpClientAuthenticationDisabled Set SMTP Client Authentication disabled or enabled at the mailbox level. ```yaml theme={null} Type: System.Boolean DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -UniversalOutlookEnabled Set Universal Outlook (the built-in Mail and Calendar app in Windows) enabled or disabled. ```yaml theme={null} Type: System.Boolean DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -WhatIf Runs the command in a mode that only reports what would happen without performing the actions. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - wi ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String\[] *Not documented.* ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Set-ExMailboxProtocol](https://ps365.clidsys.com/docs/commands/Set-ExMailboxProtocol) # Set-ExMailboxRegionalConfiguration Source: https://ps365.clidsys.com/docs/commands/Set-ExMailboxRegionalConfiguration Sets the regional configuration for Exchange mailboxes, including language, time zone, date format, and time format. # Set-ExMailboxRegionalConfiguration ## SYNOPSIS Sets the regional configuration for Exchange mailboxes, including language, time zone, date format, and time format. ## SYNTAX ### Identity (Default) ```powershell theme={null} Set-ExMailboxRegionalConfiguration [[-Identity] ] [-Language ] [-TimeZone ] [-DateFormat ] [-TimeFormat ] [-OnlyIfLanguageEmpty] [-GenerateCmdlets] [-OutputFile ] [-WhatIf] [-Confirm] ``` ### ByDomain ```powershell theme={null} Set-ExMailboxRegionalConfiguration -ByDomain [-Language ] [-TimeZone ] [-DateFormat ] [-TimeFormat ] [-OnlyIfLanguageEmpty] [-GenerateCmdlets] [-OutputFile ] [-WhatIf] [-Confirm] ``` ### FromCSV ```powershell theme={null} Set-ExMailboxRegionalConfiguration -FromCSV [-DateFormat ] [-TimeFormat ] [-OnlyIfLanguageEmpty] [-GenerateCmdlets] [-OutputFile ] [-WhatIf] [-Confirm] ``` ### AllMailboxes ```powershell theme={null} Set-ExMailboxRegionalConfiguration -AllMailboxes [-Language ] [-TimeZone ] [-DateFormat ] [-TimeFormat ] [-OnlyIfLanguageEmpty] [-GenerateCmdlets] [-OutputFile ] [-WhatIf] [-Confirm] ``` ## DESCRIPTION This function sets the regional configuration settings (language, time zone, date format, time format) for Exchange Online mailboxes. It can target mailboxes by identity, by domain, from a CSV file, or all mailboxes in the organization. It also supports generating the corresponding Set-MailboxRegionalConfiguration cmdlets without executing them. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Set-ExMailboxRegionalConfiguration -Identity "user@example.com" -Language "en-US" -TimeZone "+1" -DateFormat "MM/dd/yyyy" -TimeFormat "HH:mm" -GenerateCmdlets -OutputFile "C:\temp\cmdlets.txt" ``` Generates the Set-MailboxRegionalConfiguration cmdlet for the specified mailbox with the given regional settings and saves it to the specified file without executing it. ### EXAMPLE 2 ```powershell theme={null} Set-ExMailboxRegionalConfiguration -ByDomain "example.com" -Language "fr-FR" -TimeZone "Romance Standard Time" ``` Sets the regional configuration for all mailboxes in the specified domain to French language and Romance Standard Time zone. ### EXAMPLE 3 ```powershell theme={null} Set-ExMailboxRegionalConfiguration -FromCSV "C:\path\to\file.csv" -GenerateCmdlets -OutputFile "C:\temp\cmdlets.txt" ``` Generates the Set-MailboxRegionalConfiguration cmdlets for mailboxes listed in the specified CSV file and saves them to the specified file without executing them. ### EXAMPLE 4 ```powershell theme={null} Set-ExMailboxRegionalConfiguration -ByDomain "example.com" -Language "en-US" -TimeZone "+1" -OnlyIfLanguageEmpty ``` Sets the regional configuration only for mailboxes in the specified domain that currently have no language configured. ## PARAMETERS ### -AllMailboxes If specified, all mailboxes in the organization will be processed. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: AllMailboxes Position: Named IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ByDomain Filter mailboxes by domain name. All mailboxes with a primary SMTP address in this domain will be processed. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: ByDomain Position: Named IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Confirm Prompts you for confirmation before running the cmdlet. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - cf ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -DateFormat The date format to set for the mailbox regional configuration (e.g., 'MM/dd/yyyy', 'dd/MM/yyyy'). Auto-detected based on the specified language if not provided. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false - Name: AllMailboxes Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false - Name: ByDomain Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false - Name: Identity Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -FromCSV The path to a CSV file containing mailbox identities and optional regional configuration settings to process. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: FromCSV Position: Named IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -GenerateCmdlets If specified, the function will generate the cmdlets and save them to a file instead of executing them. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Identity The identity of the mailbox(es) to set the regional configuration for. This can be an array of email addresses, usernames, or display names. ```yaml theme={null} Type: System.String[] DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: Identity Position: 0 IsRequired: false ValueFromPipeline: true ValueFromPipelineByPropertyName: true ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Language The language code to set for the mailbox regional configuration (e.g., 'en-US', 'fr-FR'). See the ValidateSet in the parameter definition for supported language codes. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: AllMailboxes Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false - Name: ByDomain Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false - Name: Identity Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -OnlyIfLanguageEmpty If specified, the function will only modify mailboxes that currently have no language configured (empty Language property). Useful to avoid overwriting existing configurations set by users or administrators. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -OutputFile The path to the output file where generated cmdlets will be saved. Default is a timestamped file in the current directory. ```yaml theme={null} Type: System.String DefaultValue: "\"$(Get-Date -Format 'yyyy-MM-dd_HHmmss')-SetMailboxRegionalConfig_Commands.txt\"" SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -TimeFormat The time format to set for the mailbox regional configuration (e.g., 'HH:mm', 'hh:mm tt'). Auto-detected based on the specified language if not provided. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false - Name: AllMailboxes Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false - Name: ByDomain Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false - Name: Identity Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -TimeZone The time zone to set for the mailbox regional configuration. This can be a time zone ID (e.g., 'Pacific Standard Time') or a simplified offset format (e.g., '+1', '-5'). See the ValidateSet in the parameter definition for supported offset values. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: AllMailboxes Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false - Name: ByDomain Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false - Name: Identity Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -WhatIf Runs the command in a mode that only reports what would happen without performing the actions. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - wi ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ### System.String\[] *Not documented.* ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Set-ExMailboxRegionalConfiguration](https://ps365.clidsys.com/docs/commands/Set-ExMailboxRegionalConfiguration) # Set-IntuneAutoMDMEnrollmentPolicy Source: https://ps365.clidsys.com/docs/commands/Set-IntuneAutoMDMEnrollmentPolicy Configures the MDM enrollment policy for Microsoft Entra ID. # Set-IntuneAutoMDMEnrollmentPolicy ## SYNOPSIS Configures the MDM enrollment policy for Microsoft Entra ID. ## SYNTAX ```powershell theme={null} Set-IntuneAutoMDMEnrollmentPolicy [-State] [-WhatIf] [-Confirm] ``` ## DESCRIPTION This function enables or disables automatic MDM enrollment during device registration in Microsoft Entra ID. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Set-IntuneAutoMDMEnrollmentPolicy -State 'Disabled' ``` Disables automatic MDM enrollment during device registration. ### EXAMPLE 2 ```powershell theme={null} Set-IntuneAutoMDMEnrollmentPolicy -State 'Enabled' ``` Enables automatic MDM enrollment during device registration. ## PARAMETERS ### -Confirm Prompts you for confirmation before running the cmdlet. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - cf ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -State Specifies whether MDM enrollment should be enabled or disabled during registration. * 'Enabled' : Enables automatic MDM enrollment (sets isMdmEnrollmentDuringRegistrationDisabled to false) * 'Disabled' : Disables automatic MDM enrollment (sets isMdmEnrollmentDuringRegistrationDisabled to true) ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -WhatIf Runs the command in a mode that only reports what would happen without performing the actions. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - wi ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES Requires the following Microsoft Graph permissions: * Policy.ReadWrite.MobilityManagement Connect-MgGraph -Scopes 'Policy.ReadWrite.MobilityManagement' ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Set-IntuneAutoMDMEnrollmentPolicy](https://ps365.clidsys.com/docs/commands/Set-IntuneAutoMDMEnrollmentPolicy) # Set-MgEnterpriseAppStatus Source: https://ps365.clidsys.com/docs/commands/Set-MgEnterpriseAppStatus Sets the status of an enterprise application (service principal) in Microsoft Graph by setting its 'AccountEnabled' property. # Set-MgEnterpriseAppStatus ## SYNOPSIS Sets the status of an enterprise application (service principal) in Microsoft Graph by setting its 'AccountEnabled' property. ## SYNTAX ### ByApplicationID ```powershell theme={null} Set-MgEnterpriseAppStatus [-ApplicationID] [-Status] [-GenerateCmdlets] [-WhatIf] [-Confirm] ``` ### ByDisplayName ```powershell theme={null} Set-MgEnterpriseAppStatus [-DisplayName] [-Status] [-GenerateCmdlets] [-WhatIf] [-Confirm] ``` ## DESCRIPTION This function takes an Application ID or DisplayName as input and enables or disables the service principal (enterprise app) by using Invoke-MgGraphRequest to set AccountEnabled to true or false. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Set-MgEnterpriseAppStatus -ApplicationID "12345678-1234-1234-1234-123456789012" -Status "Disabled" ``` This command disables the enterprise application with the specified App ID. ### EXAMPLE 2 ```powershell theme={null} Set-MgEnterpriseAppStatus -DisplayName "MyApp" -Status "Enabled" ``` This command enables the enterprise application with the specified display name. ## PARAMETERS ### -ApplicationID The App ID of the service principal to modify. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: ByApplicationID Position: 0 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Confirm Prompts you for confirmation before running the cmdlet. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - cf ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -DisplayName The display name of the service principal to modify. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: ByDisplayName Position: 0 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -GenerateCmdlets If specified, the function will generate the cmdlets and save them to a file instead of executing them. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Status The status to set for the enterprise application. Valid values are 'Enabled' or 'Disabled'. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 1 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -WhatIf Runs the command in a mode that only reports what would happen without performing the actions. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - wi ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES To modify a registered application, use the `Set-MgRegisteredAppStatus` function instead. ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Set-MgEnterpriseAppStatus](https://ps365.clidsys.com/docs/commands/Set-MgEnterpriseAppStatus) # Set-MgRegisteredAppStatus Source: https://ps365.clidsys.com/docs/commands/Set-MgRegisteredAppStatus Sets the status of a registered application in Microsoft Graph by setting its 'isDisabled' property. # Set-MgRegisteredAppStatus ## SYNOPSIS Sets the status of a registered application in Microsoft Graph by setting its 'isDisabled' property. ## SYNTAX ### ByApplicationID ```powershell theme={null} Set-MgRegisteredAppStatus [-ApplicationID] [-Status] [-GenerateCmdlets] [-WhatIf] [-Confirm] ``` ### ByDisplayName ```powershell theme={null} Set-MgRegisteredAppStatus [-DisplayName] [-Status] [-GenerateCmdlets] [-WhatIf] [-Confirm] ``` ## DESCRIPTION This function takes an Application ID or DisplayName as input and enables or disables the registered application by using Invoke-MgGraphRequest to set isDisabled to true or false/null. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Set-MgRegisteredAppStatus -ApplicationID "your-application-id" -Status "Disabled" ``` This command disables the registered application with the specified Application ID. ### EXAMPLE 2 ```powershell theme={null} Set-MgRegisteredAppStatus -DisplayName "MyApp" -Status "Enabled" ``` This command enables the registered application with the specified display name. ## PARAMETERS ### -ApplicationID The unique identifier of the registered application to modify. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: ByApplicationID Position: 0 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Confirm Prompts you for confirmation before running the cmdlet. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - cf ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -DisplayName The display name of the registered application to modify. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: ByDisplayName Position: 0 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -GenerateCmdlets If specified, the function will generate the cmdlets and save them to a file instead of executing them. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Status The status to set for the registered application. Valid values are 'Enabled' or 'Disabled'. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 1 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -WhatIf Runs the command in a mode that only reports what would happen without performing the actions. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: '' SupportsWildcards: false Aliases: - wi ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES To modify a service principal/enterprise app, use the `Set-MgEnterpriseAppStatus` function instead. ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Set-MgRegisteredAppStatus](https://ps365.clidsys.com/docs/commands/Set-MgRegisteredAppStatus) # Switch-AzureCliAuthMode Source: https://ps365.clidsys.com/docs/commands/Switch-AzureCliAuthMode Switches Azure CLI authentication between browser and WAM modes. # Switch-AzureCliAuthMode ## SYNOPSIS Switches Azure CLI authentication between browser and WAM modes. ## SYNTAX ### Toggle (Default) ```powershell theme={null} Switch-AzureCliAuthMode ``` ### Specify ```powershell theme={null} Switch-AzureCliAuthMode [-Mode ] ``` ### GetCurrent ```powershell theme={null} Switch-AzureCliAuthMode [-GetCurrent] ``` ## DESCRIPTION Toggles the Windows broker (WAM) setting when using `az login`. If no mode is specified, it toggles between modes. If a mode is specified, it switches to that mode. Beginning with Azure CLI version 2.61.0, Web Account Manager (WAM) is the default authentication method on Windows. WAM is a Windows 10+ component that acts as an authentication broker. An authentication broker is an application that runs on a user's machine. It manages the authentication handshakes and token maintenance for connected accounts. Using WAM has several benefits: * Enhanced security. See Conditional Access: Token protection (preview). * Support for Windows Hello, conditional access policies, and FIDO keys. * Streamlined single sign-on. * Bug fixes and enhancements shipped with Windows. Technically this opens a window for login. But, in some cases, especially when connecting to client environments, it might be preferable to use the browser-based authentication method. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Switch-AzureCliAuthMode ``` Toggles between browser and WAM authentication modes. ### EXAMPLE 2 ```powershell theme={null} Switch-AzureCliAuthMode -Mode Browser ``` Switches to browser-based authentication. ### EXAMPLE 3 ```powershell theme={null} Switch-AzureCliAuthMode -Mode WAM ``` Switches to Web Account Manager authentication. ### EXAMPLE 4 ```powershell theme={null} Switch-AzureCliAuthMode -GetCurrent ``` Displays the current authentication mode. ## PARAMETERS ### -GetCurrent Displays the current authentication mode without making any changes. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: GetCurrent Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Mode The authentication mode to switch to. Valid values are 'Browser' or 'WAM'. If not specified, the function will toggle between the current modes. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: Specify Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Switch-AzureCliAuthMode](https://ps365.clidsys.com/docs/commands/Switch-AzureCliAuthMode) # Switch-AzurePowerShellMode Source: https://ps365.clidsys.com/docs/commands/Switch-AzurePowerShellMode Switches Azure PowerShell authentication between browser and WAM modes. # Switch-AzurePowerShellMode ## SYNOPSIS Switches Azure PowerShell authentication between browser and WAM modes. ## SYNTAX ### Toggle (Default) ```powershell theme={null} Switch-AzurePowerShellMode ``` ### Specify ```powershell theme={null} Switch-AzurePowerShellMode [-Mode ] ``` ### GetCurrent ```powershell theme={null} Switch-AzurePowerShellMode [-GetCurrent] ``` ## DESCRIPTION Toggles the Windows broker (WAM) setting when using `Connect-AzAccount`. If no mode is specified, it toggles between modes. If a mode is specified, it switches to that mode. Using WAM has several benefits: * Enhanced security. See Conditional Access: Token protection (preview). * Support for Windows Hello, conditional access policies, and FIDO keys. * Streamlined single sign-on. * Bug fixes and enhancements shipped with Windows. Technically this opens a window for login. But, in some cases, especially when connecting to client environments, it might be preferable to use the browser-based authentication method. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Switch-AzurePowerShellMode ``` Toggles between browser and WAM authentication modes. ### EXAMPLE 2 ```powershell theme={null} Switch-AzurePowerShellMode -Mode Browser ``` Switches to browser-based authentication. ### EXAMPLE 3 ```powershell theme={null} Switch-AzurePowerShellMode -Mode WAM ``` Switches to Web Account Manager authentication. ### EXAMPLE 4 ```powershell theme={null} Switch-AzurePowerShellMode -GetCurrent ``` Displays the current authentication mode. ## PARAMETERS ### -GetCurrent Displays the current authentication mode without making any changes. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: GetCurrent Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Mode The authentication mode to switch to. Valid values are 'Browser' or 'WAM'. If not specified, the function will toggle between the current modes. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: Specify Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Switch-AzurePowerShellMode](https://ps365.clidsys.com/docs/commands/Switch-AzurePowerShellMode) # Switch-MgGraphPowerShellMode Source: https://ps365.clidsys.com/docs/commands/Switch-MgGraphPowerShellMode Switches Microsoft Graph PowerShell authentication mode between Browser and WAM. # Switch-MgGraphPowerShellMode ## SYNOPSIS Switches Microsoft Graph PowerShell authentication mode between Browser and WAM. ## SYNTAX ### Toggle (Default) ```powershell theme={null} Switch-MgGraphPowerShellMode ``` ### Specify ```powershell theme={null} Switch-MgGraphPowerShellMode [-Mode ] ``` ### GetCurrent ```powershell theme={null} Switch-MgGraphPowerShellMode [-GetCurrent] ``` ## DESCRIPTION Toggles the Windows broker (WAM) setting when using `Connect-MgGraph`. If no mode is specified, it toggles between modes. If a mode is specified, it switches to that mode. Using WAM has several benefits: * Enhanced security. See Conditional Access: Token protection (preview). * Support for Windows Hello, conditional access policies, and FIDO keys. * Streamlined single sign-on. * Bug fixes and enhancements shipped with Windows. Technically this opens a window for login. But, in some cases, especially when connecting to client environments, it might be preferable to use the browser-based authentication method. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Switch-MgGraphPowerShellMode ``` Toggles between browser and WAM authentication modes. ### EXAMPLE 2 ```powershell theme={null} Switch-MgGraphPowerShellMode -Mode Browser ``` Switches to browser-based authentication. ### EXAMPLE 3 ```powershell theme={null} Switch-MgGraphPowerShellMode -Mode WAM ``` Switches to Web Account Manager authentication. ### EXAMPLE 4 ```powershell theme={null} Switch-MgGraphPowerShellMode -GetCurrent ``` Displays the current authentication mode. ## PARAMETERS ### -GetCurrent Displays the current authentication mode without making any changes. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: GetCurrent Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Mode The authentication mode to switch to. Valid values are 'Browser' or 'WAM'. If not specified, the function will toggle between the current modes. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: Specify Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Switch-MgGraphPowerShellMode](https://ps365.clidsys.com/docs/commands/Switch-MgGraphPowerShellMode) # Test-ExCalendarPermission Source: https://ps365.clidsys.com/docs/commands/Test-ExCalendarPermission Tests whether delegates with calendar folder permissions still exist. # Test-ExCalendarPermission ## SYNOPSIS Tests whether delegates with calendar folder permissions still exist. ## SYNTAX ```powershell theme={null} Test-ExCalendarPermission [-Mailbox] [[-DelegateStatus] ] ``` ## DESCRIPTION Retrieves the calendar folder permissions for a given mailbox and checks whether each delegate (the person the calendar was shared with) is still a valid recipient. Default and anonymous entries are excluded. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Test-ExCalendarPermission -Mailbox "user@domain.com" ``` Tests all calendar permissions for the specified mailbox and returns a list of delegates with their existence status. ### EXAMPLE 2 ```powershell theme={null} Test-ExCalendarPermission -Mailbox "user@domain.com" -DelegateStatus Missing ``` Tests calendar permissions for the specified mailbox and returns only delegates that no longer exist as recipients (orphaned permissions). ## PARAMETERS ### -DelegateStatus Filters the results based on whether the delegate (the person with whom the calendar has been shared, i.e. who appears in the calendar folder permissions) still exists as a valid recipient in the tenant. * All : returns every delegate, regardless of existence (default). * Existing : returns only delegates that still exist as recipients. * Missing : returns only delegates that no longer exist (orphaned permissions left behind after the account was deleted). ```yaml theme={null} Type: System.String DefaultValue: All SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 1 IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Mailbox The mailbox to inspect (e.g. [user@domain.com](mailto:user@domain.com)). ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: 0 IsRequired: true ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES ## RELATED LINKS *Not documented.* # Test-ExMailboxProxyAddress Source: https://ps365.clidsys.com/docs/commands/Test-ExMailboxProxyAddress Test if a given proxy address exists in the proxy addresses of a mailbox. # Test-ExMailboxProxyAddress ## SYNOPSIS Test if a given proxy address exists in the proxy addresses of a mailbox. ## SYNTAX ### Single ```powershell theme={null} Test-ExMailboxProxyAddress [-Mailbox ] [-ProxyAddress ] [-MatchOnly] [-NotMatchOnly] ``` ### Csv ```powershell theme={null} Test-ExMailboxProxyAddress [-CsvPath ] [-MailboxColumn ] [-ProxyAddressColumn ] [-MatchOnly] [-NotMatchOnly] ``` ## DESCRIPTION This cmdlet checks whether a specified proxy address is present in the proxy addresses of a given mailbox. It can process a single mailbox/proxy address pair or read multiple entries from a CSV file. ## EXAMPLES ### EXAMPLE 1 ```powershell theme={null} Test-ExMailboxProxyAddress -Mailbox "user@example.com" -ProxyAddress "alias@example.com" ``` Tests if "[alias@example.com](mailto:alias@example.com)" exists in the proxy addresses of the mailbox "[user@example.com](mailto:user@example.com)". ### EXAMPLE 2 ```powershell theme={null} Test-ExMailboxProxyAddress -CsvPath "C:\path\to\file.csv" -MailboxColumn "PrimarySmtpAddress" -ProxyAddressColumn "OnMicrosoftAddress" ``` Reads mailbox and proxy address pairs from the specified CSV file and tests each pair. ### EXAMPLE 3 ```powershell theme={null} Test-ExMailboxProxyAddress -CsvPath "C:\path\to\file.csv" -MatchOnly ``` Reads mailbox and proxy address pairs from the specified CSV file and returns only those that match. ### EXAMPLE 4 ```powershell theme={null} Test-ExMailboxProxyAddress -CsvPath "C:\path\to\file.csv" -NotMatchOnly ``` Reads mailbox and proxy address pairs from the specified CSV file and returns only those that do not match. ## PARAMETERS ### -CsvPath The path to a CSV file containing mailbox and proxy address pairs. This parameter is used when processing multiple entries from a CSV file. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: Csv Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -Mailbox The identity of the mailbox to check (e.g., email address, alias, or GUID). This parameter is used when processing a single mailbox/proxy address pair. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: Single Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -MailboxColumn The name of the column in the CSV file that contains mailbox identities. Default is 'PrimarySmtpAddress'. ```yaml theme={null} Type: System.String DefaultValue: PrimarySmtpAddress SupportsWildcards: false Aliases: [] ParameterSets: - Name: Csv Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -MatchOnly If specified, only returns entries where the proxy address matches. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -NotMatchOnly If specified, only returns entries where the proxy address does not match. ```yaml theme={null} Type: System.Management.Automation.SwitchParameter DefaultValue: False SupportsWildcards: false Aliases: [] ParameterSets: - Name: (All) Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ProxyAddress The proxy address to check for in the mailbox's proxy addresses. This parameter is used when processing a single mailbox/proxy address pair. ```yaml theme={null} Type: System.String DefaultValue: '' SupportsWildcards: false Aliases: [] ParameterSets: - Name: Single Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### -ProxyAddressColumn The name of the column in the CSV file that contains proxy addresses. Default is 'OnMicrosoftAddress'. ```yaml theme={null} Type: System.String DefaultValue: OnMicrosoftAddress SupportsWildcards: false Aliases: [] ParameterSets: - Name: Csv Position: Named IsRequired: false ValueFromPipeline: false ValueFromPipelineByPropertyName: false ValueFromRemainingArguments: false DontShow: false AcceptedValues: [] HelpMessage: '' ``` ### CommonParameters This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216). ## INPUTS ## OUTPUTS ## NOTES ## RELATED LINKS * [https://ps365.clidsys.com/docs/commands/Test-ExMailboxProxyAddress](https://ps365.clidsys.com/docs/commands/Test-ExMailboxProxyAddress) # Introduction Source: https://ps365.clidsys.com/index Comprehensive PowerShell module for Microsoft 365 tenant management and automation # PS365 - PowerShell for Microsoft 365 PowerShell module for Microsoft 365 tenant management PS365 is a comprehensive collection of PowerShell functions designed to simplify and automate Microsoft 365 administration tasks. Whether you're managing Exchange Online, Microsoft Entra ID, or other Microsoft 365 services, PS365 provides you with secure and reliable tools for efficient tenant management. ## Features * **Powerful Automation** - Streamline complex Microsoft 365 administration tasks * **Well Documented** - Comprehensive guides, examples, and parameter descriptions * **(Relatively) Easy to Use** - Simple PowerShell cmdlets with intuitive parameters * **Multi-Service Support** - Works with Exchange Online, Entra ID, Teams, and more ## Key Capabilities ### Authentication & Identity Management * **Authentication Methods Analysis** - Deep insights into user MFA configurations * **User Authentication Reporting** - Comprehensive reports with Excel export capabilities * **Method ID tracking** - Track and analyze authentication method usage patterns * **Duplicate Detection** - Identify shared phone numbers and authentication overlaps ### Exchange Online Management * **Mailbox Administration** - Efficient mailbox management and reporting * **Recipient Analysis** - Detailed recipient type detection and classification * **Integration Ready** - Seamless integration with Exchange Online PowerShell ### Microsoft Graph Integration * **Beta API Support** - Access to latest Microsoft Graph Beta endpoints * **Enhanced Properties** - Get LastUsedDateTime, CreatedDateTime, and clientAppName * **Bulk Operations** - Efficient parallel processing for large tenants * **Error Handling** - Robust error management and logging ## Core Functions ### `Get-MgAuthNMethodInfo` Advanced authentication method analysis for Microsoft 365 users with comprehensive reporting capabilities. **Key Features:** * Support for all authentication method types (Phone, Authenticator, FIDO2, etc.) * Excel export with multiple analysis sheets * Duplicate phone number detection * Method ID tracking and analysis * Beta Microsoft Graph API integration for enhanced data ## Reporting & Analytics ### Excel Integration * **Multi-Sheet Reports** - Organized data across multiple Excel worksheets * **Shared Phone Analysis** - Identify phone numbers used by multiple users * **Visual Analytics** - Auto-sized columns and filtering for easy analysis * **Empty Sheet Handling** - Consistent sheet structure even when no data exists ### Data Export Formats * **PowerShell Objects** - Native PowerShell object output for scripting * **Excel Files** - Professional Excel reports with multiple worksheets * **Structured Data** - Properly formatted data with consistent schemas ## Security & Compliance ### Authentication & Permissions * **Microsoft Graph Scopes** - Proper scope management for secure access * **Token Management** - Efficient token handling and renewal * **Multi-Tenant Support** - Works across different Microsoft 365 tenants ### Data Protection * **Secure Data Handling** - No credential storage or logging * **Privacy Focused** - Minimal data collection and processing * **Audit Ready** - Comprehensive logging for compliance requirements ## Use Cases ### IT Administrators * **Security Audits** - Comprehensive authentication method analysis * **Compliance Reporting** - Generate reports for security compliance * **User Management** - Efficient bulk user operations and analysis ### Security Teams * **Risk Assessment** - Identify users with weak authentication setups * **Shared Resource Detection** - Find shared phone numbers across users * **Authentication Monitoring** - Track authentication method usage patterns ### Microsoft 365 Consultants * **Tenant Assessment** - Quick analysis of client Microsoft 365 environments * **Migration Planning** - Understanding current authentication landscapes * **Best Practice Implementation** - Guidance based on comprehensive data ## Continuous Development PS365 is actively maintained and regularly updated with: * New Microsoft Graph API features * Enhanced reporting capabilities * Additional Microsoft 365 service support * Performance improvements and bug fixes * Community-driven feature requests ## Support & Community * **Documentation** - Comprehensive guides and examples * **GitHub Issues** - Bug reports and feature requests *** *PS365 - Making Microsoft 365 administration simple and efficient.* # Quickstart Source: https://ps365.clidsys.com/quickstart Get started with PS365 module in minutes ## Installation PS365 is a PowerShell module that provides Microsoft 365 administration utilities. Choose the installation method based on your PowerShell version. **PowerShell 7+ is recommended** for the best experience and performance. ### PowerShell 7+ (Recommended) For PowerShell 7 and later versions, use `Install-PSResource`: ```powershell theme={null} Install-PSResource -Name PS365 -Scope CurrentUser ``` ### Windows PowerShell 5.1 For Windows PowerShell 5.1, use `Install-Module`: ```powershell theme={null} Install-Module -Name PS365 -Scope CurrentUser ``` ### Verify Installation **PowerShell 7+:** ```powershell theme={null} Get-PSResource PS365 ``` **Windows PowerShell 5.1:** ```powershell theme={null} Get-Module PS365 -ListAvailable ``` ## Getting Started Once installed, import the module and start using the commands: ```powershell theme={null} Import-Module PS365 # Example: Get Exchange mailbox information Get-ExMailboxByDomain -Domain "contoso.com" # Example: Get Entra ID application assignments Get-MgApplicationAssignment ``` Use `Get-Command -Module PS365` to see all available commands in the module. ## Next Steps Explore the available commands and their documentation: Manage Exchange Online mailboxes and configurations. Work with Entra ID applications and users. Deploy and manage Microsoft 365 applications. Generate compliance and security reports.