Table of Contents
Microsoft Artifact Registry Positioned as Trusted Location for First-Party Modules
On May 20, 2026, Microsoft published a blog post to advocate PowerShell developers to make two significant changes by using:
- PSResourceGet to manage PowerShell modules, such as installing modules from a trusted repository. PSResourceGet supports multiple repositories, which apparently means that you can “separate package discovery from package consumption.” In this context, discovery means exploring repositories for modules that you might want to use, while consumption means installation of modules from a trusted repository.
- The Microsoft Artifact Registry (MAR) as the source for Microsoft PowerShell modules. MAR promises to be “a Microsoft-controlled publishing pipeline” with “strong provenance and ownership guarantees” and “Improved availability guarantees compared to PowerShell Gallery.”
In a nutshell, Microsoft wants customers to move away from the PowerShell gallery as a trusted installation source for Microsoft modules. Instead, they want customers to use the Microsoft Artifact Registry instead, especially as the source for internal repositories used for production installations. Microsoft says that using MAR removes ambiguity about where to find and install Microsoft modules from and reduces “reliance on community mirrors for first-party artifacts.”
A Laudable Effort
It’s nice of Microsoft to create a new trusted repository to hold PowerShell and other artifacts (like Docker images). Unlike the PowerShell Gallery (created by Microsoft circa 2015), MAR won’t host community-generated modules and scripts. Although community-created contributions published via the PowerShell Gallery have driven an enormous amount of innovation and value for customers (the ImportExcel module is a favorite version of mine that I use in many scripts), there’s no doubt that the lack of control over publication means that trust issues can arise. It’s easy to inject malicious code into a module or publish a module that seems to be authentic and created by Microsoft, but isn’t.
Microsoft doesn’t want to dump the PowerShell Gallery, but they say that from a security perspective, the PowerShell Gallery should be deemed to be untrusted by default and unsuitable for production dependency. In other words, don’t download modules from the PowerShell Gallery and use them for production purposes without testing the modules first.
The Practical Experience
The only problem for anyone working with PowerShell in the Microsoft 365 ecosystem is that the common modules used for day-to-day automation are not available through the Microsoft Artifact Registry, specifically these modules:
- Microsoft Teams.
- SharePoint Online management.
- PnP.PowerShell.
- Exchange Online management.
- Microsoft Graph PowerShell SDK (available as an OCI index image, but not installable using the Install-PSResource cmdlet from the MAR).
The only module I found that I use (only occasionally) is Az.Accounts (Figure 1), where the OCI artifact stored in MAR is structured so that PSResourceGet can interpret it as a PSResource. If this doesn’t happen, you can’t use Install-PSResource to install a module from the MAR. The Microsoft Graph PowerShell SDK publishes to the MAR as a container-style OCI artifact, but not as a PSResource package.
Here are some commands to show how to register the Microsoft Artifact Registry as a trusted repository, list the available set of repositories, search the MAR for the Az.Accounts module, and install the Az.Accounts module from the MAR:
Register-PSResourceRepository -Name 'MicrosoftArtifactRegistry' -Uri 'https://mcr.microsoft.com/' -Trusted:$true -Priority 40 Get-PSResourceRepository Name Uri Trusted Priority IsAllowedByPolicy ---- --- ------- -------- ----------------- MicrosoftArtifactRegistry https://mcr.microsoft.com/ True 40 True PSGallery https://www.powershellgallery.com/api/v2 False 50 True Find-PSResource -Repository 'MicrosoftArtifactRegistry' -name 'Az.Accounts' | Format-Table Name, Version, Repository Name Version Repository ---- ------- ---------- Az.Accounts 5.5.0 MicrosoftArtifactRegistry Install-PSResource -Name Az.Accounts -Repository 'MicrosoftArtifactRegistry' -Scope AllUsers -Version 5.5
Waiting for Modules to Catch Up with the Vision
It’s a good idea to have a trusted repository for PowerShell modules, just like it’s a good idea to have a repository for community contributions, with all the caveats that entails. However, to be successful, the people running the Microsoft Artifact Registry have a ton of work ahead of them to persuade development groups to make the necessary updates to the publication pipeline for their PowerShell modules to make the modules easy to install and update from the MAR.
Like everything else, progress toward the end goal will be gradual. How long it will take depends largely on the priorities and workload of the development groups and their ability to adapt their release processes to accommodate the Microsoft Artifact Registry. Until that happens, we’ll balance Microsoft’s strategic desire against the practical reality of having to install modules from the PowerShell gallery.
Need help to write and manage PowerShell scripts for Microsoft 365, including Azure Automation runbooks? Get a copy of the Automating Microsoft 365 with PowerShell eBook, available standalone or as part of the Office 365 for IT Pros eBook bundle.