After some major developments in the world of Microsoft 365 PowerShell, we’ve updated the Automating Microsoft 365 with PowerShell eBook to version 29.2. Refreshed EPUB and PDF files are available for current subscribers to download from Gumroad.com. This release will eventually form part of the Microsoft 365 for IT Pros November 2026 update. The nice thing about electronic publishing is that we can put information in our readers’ hands as soon as we’ve had time to analyze changes.
File-level archiving is now generally available and can be applied to files automatically, by users through the SharePoint browser UX, or via a Graph API. The big problem with Purview retention processing is its black box nature, so to discover how effective retention labels with an archiving step are, we use the Microsoft Graph PowerShell SDK to check the archiving status of files and report the results via email. All in a nice script, of course.
If you use the Microsoft Graph PowerShell SDK, you might know that the Graph APIs for SharePoint sites sometimes need a little help. For instance, finding a set of sites to process can be problematic because the APIs do not support extensive filtering capabilities. The solution is to use other Microsoft 365 cmdlets to find objects associated with sites. Inserting an intermediate step might seem crazy, but it can be the most effective way of solving the problem.
The problem with V2.41 of the Microsoft Graph PowerShell SDK that stopped runbooks executing in PowerShell V7 runtime environments was disappointing. However, it was also a good wake-up call for tenant administrators to pay attention to maintaining healthy Azure Automation custom runtime environments. This article proposes a separation between current and production environments and explains how to use PowerShell to get the right modules to the right place.
The File-level archiving API supports any file stored in a SharePoint Online document library, including the emails sent to Teams channels and stored in folders where the email files often disappear from view, occupying valuable storage quietly and without fuss. Finding and moving the email files to Microsoft 365 Archive makes sense because it saves on storage and stops AI tools using old email to generate responses. Here’s how to archive old email files with PowerShell.
The Microsoft Graph PowerShell SDK has long been plagued by assembly clashes that meant it couldn’t be used in the same session as other Microsoft 365 modules. After Microsoft engineering groups looked at the problem for 18 months, a solution was found by MVP Stephen van Rooij and is now available in V2.41. Apart from an issue with old PowerShell 7 versions, the fix looks solid and the SDK can once again be loaded into PowerShell sessions alongside the Exchange Online and Teams modules.
Administrators know how to use the default Microsoft Graph Command Line Tools app for delegated interactive Graph sessions. In this article, we cover the topic of using custom Entra ID apps to enable granular access for selected users who need some, but not all, Graph permissions to get their work done. Some changes have taken place in this area due to the advent of WAM, but the concepts and implementation steps are straightforward.
On September 16, 2026, Microsoft announced a 12-month retirement period for support of PowerShell V5.1 by the Microsoft Graph PowerShell SDK. Microsoft also announced V3 of the Graph SDK and said that the new version will only support PowerShell V7. The transition for most scripts should be straightforward, but attention needs to be paid when scripts use outdated .NET assemblies. Famous last words…
A Technical Community post discusses the topic of using the Entra ID continuous access evaluation (CAE) feature to revoke access for service principals when apps become risky or potentially compromised. The Microsoft Graph Command Line Tools app is a good example of a service principal in common use, so we examine the access tokens issued for interactive Graph sessions to discover if they are CAE-enabled. Just for fun!
After Microsoft released some new Graph permissions, thoughts turned to how to discover new permissions after they are released. Code is the best way to perform automatic checks, and this article explains how to use PowerShell to check a last known set (stored in SharePoint Online) against the current set. Any variations are reported to administrators via email. It’s nice to automate this kind of operation.
In a GitHub post, Microsoft says that interactive Graph sessions using the default Microsoft Graph Command Line Tools app will use WAM in the future. Some administrators use older versions of the Microsoft Graph PowerShell SDK for continued access to browser-based authentication, but this won’t be possible once Microsoft makes the server-side change to enforce WAM on an undefined future date. Teams and Exchange Online also use WAM, apparently for better security.
Microsoft Purview supports retention policies for Planner tasks and that’s the supported way to remove old tasks from plans. But you can also remove old Planner tasks with PowerShell. Just for fun, we show how to find and delete old tasks using the Microsoft Graph PowerShell SDK. Cleaning out obsolete tasks that have been hanging around plans for years speeds up client access. It’s a form of colonic irrigation for plans!
After the discussion about the licensing gap prompts shown in the Entra admin center, here’s a PowerShell script to compute the set of user accounts that should have Entra P1 licenses. The information comes from the conditions property of conditional access policies with group and directory role membership expanded to find individual accounts. The set is checked against the set of users licensed for Entra P1 to find the accounts that need to be licensed.
Accumulating statistics for open tasks in a Planner plan is helpful to understand how active team members are in clearing assigned tasks. Creating a report showing how the number of open tasks vary by team member over a six-week period delivers another type of insight. It’s the kind of thing that PowerShell is very good at. If data is available, we can report it in different ways!
The Invoke-ChangeMeetingOrganizer cmdlet can transfer meeting ownership from one user to another. In this article, we discuss using a script to transfer meetings in bulk between users. The code requires a mixture of Exchange Online and the Microsoft Graph using a registered Entra ID app. It all sounds complicated, but really isn’t – and the code handles scenarios like transferring meetings from someone leaving the organization.
The Microsoft Graph PowerShell Command Line tools app is how people run Microsoft Graph PowerShell SDK cmdlets. The app can suffer from permissions creep, meaning that over time, the app accrues a set of delegated permissions used by people to access different types of Microsoft 365 and Entra ID information. All is fine until an internal limit is reached, at which point authentication fails and some permissions must be pruned.
An old article from 2021 written about how to create a report detailing managers and direct reports from Azure AD needs revision. This version uses the Microsoft Graph APIs and explains how to work around a known issue with Graph filtering with a mixture of server-side and client-side filters. It’s the kind of update that PowerShell scripts need when technology change – or when we learn how to do things better.
It’s common to find that tenants have many inactive channels in their Teams deployment. Becoming inactive is a natural side-effect of time eroding interest in the topics people discuss in channels. And if you don’t go looking for inactive channels, they’ll remain silently in place doing nothing except acting as a container for potentially obsolete long-over discussions. But we can find inactive channels with PowerShell. What you next is up to you.
The third edition of the Automating Microsoft 365 with PowerShell eBook is now available in EPUB and PDF formats. The paperback version will be available on July 1. This 430-page eBook offers the most comprehensive coverage of automating tenant management operations for Microsoft 365 and includes a swathe of practical, worked-out examples to help tenant administrators build scripts to automate tasks.
A new version of the Microsoft Graph PowerShell SDK (V2.38) is available, as is a new version of the Exchange Online Management module. They don’t work well together. It’s annoying and beyond frustrating that two critical PowerShell modules in the Microsoft 365 ecosystem cannot work together. If anything, the situation is getting worse. On the upside, I found out about two cmdlets that I might never use – but who knows!
Sometimes, Microsoft 365 tenants need to remove problematic Teams chat threads from user view. The usual reason is because someone posted some bad or objectionable content to Teams. This article covers how to use Microsoft Graph PowerShell SDK cmdlets to find chat threads, to check thread messages for targeted content, and to remove matching chat threads. The code can be run interactively by an administrator to clean up Teams.
Three cmdlets exist to fetch sensitivity labels. One is in the Exchange Online module; the others are powered by Graph APIs. What are the differences between each method and how can you make sure that the set of sensitivity labels fetched by PowerShell is the full set of available labels? These and other questions are investigated in this article.
Inactive accounts can soak up a lot of paid-for but unused product licenses. With increases for Microsoft 365 licenses due to come into effect from 1 July 2026, it’s time to find and remove unused licenses from inactive user accounts. We discuss two approaches by using the Microsoft 365 Licensing Report or a PowerShell script that assesses inactivity based on sign-in dates and refresh token baselines.
Some days ago, I wrote about creating a new employee welcome email with ICS files for corporate events. As it turns out, Inviting employees to attend those events by updating the participant list with PowerShell is an easier and better approach. This article explains how to find calendar events, update participant lists, and update events with the Microsoft Graph PowerShell SDK.
ICS files are a useful method to send information about calendar events between different IT systems. This article discusses creating ICS files for Teams Online meetings as part of a project to send welcome messages to new employees that contain information about upcoming corporate events that the new people might like to attend. Suffice to say that formatting the ICS files to Outlook’s satisfaction takes some effort.
Version 24 of the Automating Microsoft 365 with PowerShell eBook is now available for current subscribers to download. The updated PDF and EPUB files are available from Gumroad.com. The paperback edition is also updated. In other news, a new version of the Microsoft Graph PowerShell SDK is available, and Microsoft has created a problem of their own making by announcing the retirement of the AutoRest utility.
Understanding what Graph permissions are required by apps can be challenging. In this article we discuss how the Group.Read.All and GroupMember.Real.All permissions work and why you should choose one permission over the other and respect the principle of least permission when it comes to assigning Graph permissions to your apps and PowerShell scripts.
This article discusses how to list files archived using the SharePoint Online file-level archiving feature. We also discuss how to archive and unarchive files using the Microsoft Graph PowerShell SDK and Graph API requests. As it turns out, the drives API is the best way to find (list) archived or unarchived files, while archiving files that haven’t been modified in a while is easy with a few lines of PowerShell.
Now rolling out to Microsoft 365 tenants is the ability to update user profile cards with details of awards and certifications held by users. Usually this would be done through a Copilot connector, but it’s possible to add awards and certifications using Microsoft Graph PowerShell SDK cmdlets. All explained in great detail with working examples here.
In 2024, I wrote a script explaining how to report details of Teams online meetings, including participants. Now someone wants to report single-user meetings. Their reason is that company management believe that some remote workers schedule online meetings that only they attend with the intention of appearing active if anyone checks. It’s an odd ask, but we can do the job with PowerShell.
The additionalProperties property is available for many Microsoft Graph PowerShell SDK cmdlets. In this article, we explain the function of the additionalProperties property and how it functions in holding output for Microsoft Graph PowerShell SDK cmdlets. It’s all because of the lack of strongly typed properties, or so the AutoRest process would have us believe.
The May 2026 update for the Automating Microsoft 365 with PowerShell eBook is available. Current subscribers can download new PDF and EPUB files. The paperback edition of the book (available on demand from Amazon) is also updated. With over 400 pages of content, including twice that number of practical examples of using PowerShell to interact with Microsoft 365, the book is going from strength to strength.
A reader wanted a weekly incomplete task digest to send details of Planner tasks to people with outstanding work to do. We used PowerShell to scan for incomplete tasks for people who are members of a group, perform some analysis on the data, and create and send email. Despite some deficiencies in the Planner Graph API, the code is pretty straightforward.
The Copilot Retrieval API is a Microsoft Graph API that apps can use to search Microsoft 365 locations to find information to ground user prompts. Grounding means that the apps use the information found by Copilot to add context to the queries they submit to a generative AI engine for processing. Although I don’t have an immediate purpose for the API, it provides a nice insight into how grounding works.
An old PowerShell script tracked changes to Office 365 Groups. The techniques from 2016 wouldn’t be used today because features like the unified audit log didn’t exist then. We show what’s possible now by creating a new version of a Microsoft 365 Groups Change Report script to track additions, deletions, and changes for Microsoft 365 groups in a tenant.
The April 2026 update for the Automating Microsoft 365 with PowerShell eBook is now available for subscribers to download. Refreshed EPUB and PDF files can be downloaded from Gumroad.com. The Kindle and paperback editions are also updated. This month we reflect on V2.36.1 of the Microsoft Graph PowerShell SDK and why so little has changed in this important component.
Some Microsoft MVPs have expressed a strong opinion that Microsoft isn’t doing enough to develop and enhance the Microsoft Graph APIs across Microsoft 365. Problems include inconsistency in implementation, undocumented APIs, assembly clashes, missing coverage, and APIs that never come out of beta. It seems like Microsoft doesn’t dedicate sufficient attention to this important topic. What do you think?
It’s easy to remove sensitivity labels from SharePoint Online files when only a few files are involved. Doing the same task at scale requires automation. In this article, we explain how to use the Microsoft Graph PowerShell SDK to find and remove sensitivity labels from files stored in SharePoint Online and OneDrive for Business.
Shared mailboxes are not CRM systems. However, many Microsoft 365 tenants use shared mailboxes to handle customer queries and then want to measure KPIs such as agent responsiveness to customer queries or the number of queries handled per agent in a month. As explored in this article, it’s possible to use the Microsoft Graph to extract some KPI-like data from shared mailboxes.
This article explains how to use scoped Graph permissions to restrict app access to lists and list items in SharePoint Online and OneDrive for Business sites. It’s a follow-up to other articles covering how to restrict app access to SharePoint Online sites and files. Scoping app access to specific objects is important because otherwise apps can access everything in SharePoint Online, and that isn’t good.
