🕸️ Graph

Read-only Graph one-liners. Copy, paste, run.

26 commands | all read only | write ones coming

Connect first: Connect-MgGraph -Scopes SCOPE using the scope listed on each card. Swap USER_UPN, GROUP_ID and GRAPH_ID placeholders. Nothing here writes.

Users and identity

Who exists, who is stale, who is a guest.

All users

User.Read.All

›

(Invoke-MgGraphRequest GET "v1.0/users?`$select=displayName,userPrincipalName,accountEnabled,userType" -OutputType PSObject).value

Guest accounts

User.Read.All

›

(Invoke-MgGraphRequest GET "v1.0/users?`$filter=userType eq 'Guest'&`$select=displayName,userPrincipalName,createdDateTime" -OutputType PSObject).value

Disabled but still licensed

User.Read.All, Directory.Read.All

›

(Invoke-MgGraphRequest GET "v1.0/users?`$filter=accountEnabled eq false&`$select=displayName,userPrincipalName,assignedLicenses" -OutputType PSObject).value | ? { $_.assignedLicenses.Count -gt 0 }

A user's auth methods

UserAuthenticationMethod.Read.All

›

(Invoke-MgGraphRequest GET "v1.0/users/USER_UPN/authentication/methods" -OutputType PSObject).value | Select-Object '@odata.type'

Licenses in the tenant

Organization.Read.All

›

(Invoke-MgGraphRequest GET "v1.0/subscribedSkus" -OutputType PSObject).value | Select-Object skuPartNumber, @{n='used';e={$_.consumedUnits}}, @{n='total';e={$_.prepaidUnits.enabled}}

Devices

Intune managed estate, compliance, and local admin.

All managed devices

DeviceManagementManagedDevices.Read.All

›

(Invoke-MgGraphRequest GET "v1.0/deviceManagement/managedDevices?`$select=deviceName,userPrincipalName,operatingSystem,complianceState,lastSyncDateTime" -OutputType PSObject).value

Non-compliant devices

DeviceManagementManagedDevices.Read.All

›

(Invoke-MgGraphRequest GET "v1.0/deviceManagement/managedDevices?`$filter=complianceState eq 'noncompliant'&`$select=deviceName,userPrincipalName,operatingSystem" -OutputType PSObject).value

Stale devices, no sync in 30 days

DeviceManagementManagedDevices.Read.All

›

$cut=(Get-Date).AddDays(-30).ToString("o"); (Invoke-MgGraphRequest GET "v1.0/deviceManagement/managedDevices?`$filter=lastSyncDateTime lt $cut&`$select=deviceName,userPrincipalName,lastSyncDateTime" -OutputType PSObject).value

LAPS device inventory

DeviceLocalCredential.ReadBasic.All

›

(Invoke-MgGraphRequest GET "v1.0/directory/deviceLocalCredentials" -OutputType PSObject).value | Select-Object deviceName, id, lastBackupDateTime

LAPS password for every device

DeviceLocalCredential.Read.All

›

(Invoke-MgGraphRequest GET "v1.0/directory/deviceLocalCredentials" -OutputType PSObject).value | % { $c=(Invoke-MgGraphRequest GET "v1.0/directory/deviceLocalCredentials/$($_.id)`?`$select=credentials" -OutputType PSObject).credentials[0]; "$($_.deviceName)`t$($c.accountName)`t$([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($c.passwordBase64)))" }

Groups

Membership, dynamic rules, the empty ones.

All groups

Group.Read.All

›

(Invoke-MgGraphRequest GET "v1.0/groups?`$select=displayName,id,groupTypes,membershipRule" -OutputType PSObject).value

Dynamic groups and their rules

Group.Read.All

›

(Invoke-MgGraphRequest GET "v1.0/groups?`$filter=groupTypes/any(c:c eq 'DynamicMembership')&`$select=displayName,membershipRule,membershipRuleProcessingState" -OutputType PSObject).value

Members of one group

GroupMember.Read.All

›

(Invoke-MgGraphRequest GET "v1.0/groups/GROUP_ID/members?`$select=displayName,userPrincipalName" -OutputType PSObject).value

Conditional Access and risk

Policies, locations, flagged identities.

All CA policies

Policy.Read.All

›

(Invoke-MgGraphRequest GET "v1.0/identity/conditionalAccess/policies" -OutputType PSObject).value | Select-Object displayName, state

Named locations

Policy.Read.All

›

(Invoke-MgGraphRequest GET "v1.0/identity/conditionalAccess/namedLocations" -OutputType PSObject).value

Risky users

IdentityRiskyUser.Read.All

›

(Invoke-MgGraphRequest GET "v1.0/identityProtection/riskyUsers?`$filter=riskState eq 'atRisk'" -OutputType PSObject).value | Select-Object userPrincipalName, riskLevel, riskLastUpdatedDateTime

Sign-in and audit

What happened, who did it.

Recent sign-ins for a user

AuditLog.Read.All

›

(Invoke-MgGraphRequest GET "v1.0/auditLogs/signIns?`$filter=userPrincipalName eq 'USER_UPN'&`$top=25" -OutputType PSObject).value | Select-Object createdDateTime, appDisplayName, ipAddress, @{n='status';e={$_.status.errorCode}}

Failed sign-ins, last 24h

AuditLog.Read.All

›

$cut=(Get-Date).AddDays(-1).ToString("o"); (Invoke-MgGraphRequest GET "v1.0/auditLogs/signIns?`$filter=createdDateTime ge $cut and status/errorCode ne 0&`$top=50" -OutputType PSObject).value | Select-Object createdDateTime, userPrincipalName, ipAddress

Directory changes, last 50

AuditLog.Read.All

›

(Invoke-MgGraphRequest GET "v1.0/auditLogs/directoryAudits?`$top=50" -OutputType PSObject).value | Select-Object activityDateTime, activityDisplayName, @{n='by';e={$_.initiatedBy.user.userPrincipalName}}

Mail

Rules and forwarding, per mailbox.

Inbox rules for a user

MailboxSettings.Read

›

(Invoke-MgGraphRequest GET "v1.0/users/USER_UPN/mailFolders/inbox/messageRules" -OutputType PSObject).value | Select-Object displayName, isEnabled, actions

Forwarding settings for a user

MailboxSettings.Read

›

(Invoke-MgGraphRequest GET "v1.0/users/USER_UPN/mailboxSettings" -OutputType PSObject) | Select-Object automaticRepliesSetting, @{n='fwd';e={$_.forwardingSmtpAddress}}

Apps and roles

Service principals, secret expiry, admin assignments.

Enterprise apps

Application.Read.All

›

(Invoke-MgGraphRequest GET "v1.0/servicePrincipals?`$select=displayName,appId,accountEnabled" -OutputType PSObject).value

App secrets and expiry dates

Application.Read.All

›

(Invoke-MgGraphRequest GET "v1.0/applications?`$select=displayName,passwordCredentials" -OutputType PSObject).value | % { foreach($c in $_.passwordCredentials){ "$($_.displayName)`t$($c.endDateTime)" } }

OAuth consent grants

Directory.Read.All

›

(Invoke-MgGraphRequest GET "v1.0/oauth2PermissionGrants" -OutputType PSObject).value | Select-Object clientId, scope, consentType

Directory role holders

RoleManagement.Read.Directory

›

(Invoke-MgGraphRequest GET "v1.0/directoryRoles" -OutputType PSObject).value | % { $r=$_.displayName; (Invoke-MgGraphRequest GET "v1.0/directoryRoles/$($_.id)/members" -OutputType PSObject).value | % { "$r`t$($_.userPrincipalName)" } }

SharePoint and OneDrive

Sites and storage.

All sites

Sites.Read.All

›

(Invoke-MgGraphRequest GET "v1.0/sites?search=*" -OutputType PSObject).value | Select-Object displayName, webUrl