This article describes how to use PowerShell to create a report for Microsoft Purview role groups and their memberships, including identifying unknown objects in group membership and expanding the amount of information reported for each role holder.
On November 17, Microsoft announced the Exchange Admin API, a REST-based method of interacting with Exchange Online administrative functions. Having a new API sounds exciting, but in reality the Exchange Admin API is a limited tool to help Exchange Web Services (EWS) developers migrate their apps before Microsoft retires EWS in October 2026. That being said, here's how the API works.
Understanding the set of registered and enterprise apps active in a Microsoft 365 tenant is important. Attackers can sneak in and plant an app to exfiltrate or otherwise steal data. This article explains how to use PowerShell to create a service principal analysis report that highlights common problems and gives tenant administrators the data needed to manage apps.
Utility accounts exist in every Microsoft 365 tenant. These accounts are not intended for normal user activity and include accounts used for Exchange room and shared mailboxes and the break-glass or emergency accounts intended to allow administrators to sign-in if their usual accounts are blocked. This article shows how to use PowerShell and the Microsoft Graph to check sign-in events to ensure that the accounts aren't being accessed.
A request came in about how to find unused proxy addresses for Exchange Online mail-enabled objects. There's no out-of-the-box report available for proxy address usage, but we can solve the problem by using a PowerShell script to download historical message trace data to check every proxy address for all mailboxes against. The question then is what to do with the unused proxy addresses?
Despite the best efforts of anti-spam solutions, some unwanted messages usually get through to user inboxes. This article explains how to analyze messages that end up in Junk Email and use the results to create a transport rule to block future traffic from the spammy domains.
Microsoft 365 comes with many usage report API covering different workloads. This article explains how to use PowerShell to extract usage data for multiple workloads to combine together to create a holistic view of user account activity within a Microsoft 365 tenant.
Many examples of how to report inactive guest accounts are available on the internet, but they're all flawed because they make decisions based on the last sign in. That's a shortsighted method because it doesn't take guest activity into account. This article explains how to combine audit data with sign-in data to create an enhanced view of guest account activity so that intelligent decisions can be made to keep or retain the accounts.
Microsoft's Alex Simons came to the TEC 2025 conference to talk about the future of Entra ID, a lot of which hangs on the use of AI in components like the Entra agents that are now in preview. The idea of using agents to relieve hard-pressed human administrators is great, but only if those agents do more than a skilled human administrator can do, and that's not the case so far.
Many PowerShell scripts need to run on a scheduled basis or have to process large amounts of data. Azure Automation runbooks are a good way to handle both types of task. This article describes three important and practical steps to improve writing PowerShell code for Azure Automation.
A reader question asked if it was possible to find the last app accessed by a user. Of course, anything is possible with PowerShell, but how? In this article, we explore using the Entra ID sign-in logs and Microsoft 365 audit log as sources for finding the desired information. Some performance issues emerge, so we end up running the code in Azure Automation.
A reader asked if it's possible to analyze the external meeting participants for Teams online events. The information is available through the Events Graph API, and some PowerShell code written using the Graph PowerShell SDK quickly extracts events to analyze and determine the set of external domains meeting participants come from.
