Microsoft Graph PowerShell Command Builder (Azure AD / Entra ID)

Azure AD / Microsoft Entra ID PowerShell Command Builder

This tool builds ready-to-run PowerShell for Microsoft Entra ID (still widely searched for as “Azure AD”). Pick a task — create a user, reset a password, audit MFA registration, list unused licences, dump sign-in logs — fill in the one or two values it needs, and copy a command that works as-is. It also tells you which Microsoft Graph permission scopes that command requires, which is the single most common reason a copied snippet fails with Insufficient privileges.

Everything runs in your browser. Nothing you type is sent anywhere, and no tenant is contacted — the tool generates text, it does not execute anything. That means you can safely paste a real UPN or tenant ID into the fields to get a command you can run without editing.

The Module Landscape Has Changed — Read This First

If you are following an older blog post, the commands in it are probably dead. The AzureAD and MSOnline PowerShell modules were retired on 30 March 2025. Cmdlets such as Connect-AzureAD, Get-AzureADUser, Set-AzureADUser and Get-MsolUser no longer have a supported service behind them. The replacement is the Microsoft Graph PowerShell SDK, whose cmdlets all carry an Mg noun prefix: Get-MgUser, New-MgGroup, Get-MgAuditLogSignIn, and so on.

This tool has a Graph / legacy toggle. Graph is the default and is what you should copy. The legacy view exists purely so you can recognise an old script and find its modern equivalent side by side — every legacy snippet is labelled as deprecated. Use it as a translation table when you inherit a scripts folder nobody has touched since 2021.

What the Tool Covers

Tasks are grouped into eight tabs:

• Connect & Setup — installing and updating the module, interactive sign-in, device code flow for machines without a browser, app-only certificate authentication for unattended automation, checking the current context, and disconnecting cleanly.
• Users — retrieve one user or list all, create, update job title and department, disable or re-enable an account, reset a password, delete, and recover a soft-deleted user from the directory recycle bin.
• Groups — create security groups and Microsoft 365 groups, add and remove members, list membership, and list a user’s group memberships.
• MFA & Auth — enumerate a user’s registered authentication methods so you can find accounts with no strong factor registered.
• Licensing — list subscribed SKUs with consumed versus available units, and assign or remove licences.
• Roles & Admin — list directory roles and their members, look up role definitions, and create a role assignment.
• Reporting & Auditing — sign-in logs, directory audit logs, and inactive-account reports driven by a threshold you choose in days, with optional CSV export.
• Devices — list registered devices, find devices owned by a specific user, and remove a stale device object.

How to Use It

1. Pick a tab matching the object you are working with — users, groups, licences, devices.
2. Select the task. Each task shows a short description of what it does before you commit to it.
3. Fill in the placeholders. Depending on the task that might be a user principal name, a group display name, an inactivity threshold in days, or a tenant ID, application ID and certificate thumbprint for app-only auth.
4. Check the required scopes. The tool lists the Graph permissions the command needs. Pass exactly those to Connect-MgGraph rather than requesting everything.
5. Copy and run. Test against a single test account before running anything that loops over your whole directory.

Getting Connected

Install the SDK once, from an elevated or user-scoped PowerShell session:

Install-Module Microsoft.Graph -Scope CurrentUser -Repository PSGallery -Force

PowerShell 7 or later is recommended on every platform; Windows PowerShell 5.1 works but needs .NET Framework 4.7.2 and an execution policy of RemoteSigned or looser. Installing the umbrella Microsoft.Graph module pulls in dozens of sub-modules, so on a constrained build agent you may prefer to install only the sub-modules you need — Microsoft.Graph.Authentication always comes along.

Then authenticate. Interactive sign-in is the normal path for ad-hoc administration:

Connect-MgGraph -Scopes "User.Read.All", "Group.Read.All"

On a server or SSH session with no browser, use device code flow, which prints a code you enter on another machine:

Connect-MgGraph -Scopes "User.Read.All" -UseDeviceCode

For scheduled and unattended work, register an application, upload a certificate, grant application permissions with admin consent, and connect with no human in the loop:

Connect-MgGraph -TenantId <tenant-id> -ClientId <app-id> -CertificateThumbprint <thumbprint>

Get-MgContext shows who you are signed in as and which scopes were actually granted — run it first whenever a command returns a permissions error. Finish with Disconnect-MgGraph, particularly on shared jump boxes.

Old Cmdlet to New Cmdlet

Things That Trip People Up

Paging. Graph returns 100 objects per page by default. Get-MgUser on its own does not return your whole tenant — add -All. Forgetting this produces reports that quietly under-count.

Property selection. Many attributes are not returned unless you ask. If a property comes back empty when you know it has a value, add it to -Property and then select it in the pipeline.

Advanced queries. Filters on some properties require the ConsistencyLevel header and a count — the error message when you omit it is unhelpfully generic.

Scopes are cumulative per session. Connecting with a narrow scope set and then running a command needing more does not silently escalate; you must reconnect requesting the additional scope.

Delegated versus application permissions. An interactive session is limited by both the granted scope and your own role. A command that works for a Global Administrator interactively can still fail under a service principal that was granted only delegated consent.

Related Tools

If you administer the wider Microsoft stack, the same command-builder pattern is available for Exchange Online PowerShell, Windows Update PowerShell, and Group Policy commands. When a task involves setting a temporary password, generate it with the secure password generator rather than reusing a pattern across accounts.

Frequently Asked Questions

Is the AzureAD PowerShell module still supported?

No. The AzureAD and MSOnline modules were retired on 30 March 2025. Scripts built on them should be migrated to the Microsoft Graph PowerShell SDK. This tool shows legacy cmdlets only for reference, clearly labelled as deprecated, so you can map an old script to its replacement.

Which module do I install?

Run Install-Module Microsoft.Graph -Scope CurrentUser -Repository PSGallery -Force. Verify with Get-InstalledModule Microsoft.Graph and keep it current with Update-Module Microsoft.Graph.

Why do I get “Insufficient privileges to complete the operation”?

The scopes granted to your session do not cover the call. Check what you actually have with Get-MgContext, then reconnect with the scopes this tool lists for that task. If you are using app-only auth, the application permission also needs admin consent in the tenant.

How do I connect without a browser?

Use device code flow: Connect-MgGraph -Scopes "User.Read.All" -UseDeviceCode. PowerShell prints a URL and a code that you enter from any other device. For fully unattended jobs, use certificate-based app-only authentication instead.

Can I find accounts with no MFA registered?

Yes — the MFA & Auth tab builds a command around Get-MgUserAuthenticationMethod that enumerates each user’s registered methods. Accounts whose only method is a password are the ones to chase.

Does the tool run commands against my tenant?

No. It generates text in your browser and never contacts Microsoft or any server of ours. Values you type stay on your machine. You run the copied command yourself, in your own session, so you keep full control over what executes.

Why does my report only show 100 users?

Graph pages results. Add -All to the cmdlet to retrieve every object rather than the first page.

Is Microsoft Entra ID the same as Azure AD?

Yes. Azure Active Directory was renamed Microsoft Entra ID; the directory, the objects and the Graph API are the same. The old name survives in search habits, documentation and countless scripts, which is why this page uses both.