PowerShell scripts

365 PowerShell scripts for reporting on, troubleshooting and tidying up Microsoft 365

Documented, read-only-by-default scripts for Intune, Entra ID, Defender, Exchange Online, Purview, Teams, SharePoint and tenant administration — the questions admins ask most often ("which devices stopped syncing?", "who forwards mail outside the company?", "which teams are dead?", "how many licences are we wasting?") turned into repeatable tools built on Microsoft Graph and Exchange Online PowerShell V3. Open source under the MIT licence.

The download is the complete repository as a .zip file, generated by GitHub from the latest version of github.com/omer-eltayeb/M365.

53Microsoft IntuneDevice inventory and compliance, remote actions, policy backup/restore, assignment matrix, apps and app protection, Autopilot and enrollment, Windows Update and remediations, BitLocker/LAPS, Cloud PC and tenant health. 52Microsoft Entra IDUsers and authentication methods, groups and devices, sign-in and audit logs, Identity Protection, applications and consent, privileged roles and PIM, governance and tenant security settings. 54Microsoft DefenderDefender XDR alerts and incidents, Secure Score, attack simulation, Defender for Identity, advanced hunting, the Defender for Endpoint API, Defender for Office 365 policies, quarantine and email authentication. 53Exchange OnlineMailbox lifecycle and holds, sizes and quotas, settings, calendars and rooms, distribution groups, mail flow and message trace, client access and mobile devices, admin audit and migration. 51Microsoft PurviewSensitivity labels and auto-labeling, DLP, retention and records, eDiscovery and content search, audit log scenarios, insider risk, communication compliance and information barriers. 51Teams, SharePoint & OneDriveTeams inventory and lifecycle, membership and guests, channels, apps and settings, Teams policies and voice, SharePoint sharing and admin, external users, storage, files and sharing links, and OneDrive. 50Microsoft 365 tenantLicensing and subscriptions, usage and adoption reports, tenant settings snapshots, service health and Message center, Microsoft 365 Groups governance, onboarding/offboarding and tenant hygiene. 1ToolsPrerequisite installer for the modules the scripts need.
The complete catalogue

All 365 scripts

Every script in the repository, with what it does and whether it changes anything. Each name opens the script on GitHub.

Product

Showing all 365 scripts

Get-IntuneBitLockerRecoveryKeys.ps1

Inventories the BitLocker recovery keys escrowed in Entra ID, joined to the owning device, optionally including the key material for selected devices.

Microsoft IntuneDevices & remote actionsReport only
Get-IntuneDeviceHardwareInventory.ps1

Builds a per-device hardware inventory (storage, memory, TPM, BIOS, battery, network) for Intune managed devices.

Microsoft IntuneDevices & remote actionsReport only
Get-IntuneDevicesPerUser.ps1

Groups Intune managed devices by primary user and reports users who own an unusually high number of devices.

Microsoft IntuneDevices & remote actionsReport only
Get-IntuneEncryptionReport.ps1

Reports the encryption state of Intune managed devices and, optionally, whether Windows devices have a BitLocker recovery key escrowed in Entra ID.

Microsoft IntuneDevices & remote actionsReport only
Get-IntuneLapsPasswords.ps1

Reports Windows LAPS password backups in Entra ID, flags stale or overdue backups and optionally retrieves the current local administrator password.

Microsoft IntuneDevices & remote actionsReport only
Get-IntuneOrphanedDevices.ps1

Reports Intune managed devices whose primary user is missing, deleted from Entra ID or disabled.

Microsoft IntuneDevices & remote actionsReport only
Get-IntuneStaleDevices.ps1

Reports Intune managed devices that have not synced for a given number of days and can optionally retire or delete them.

Microsoft IntuneDevices & remote actionsRead-only unless you add a switchWalkthrough
Invoke-IntuneCollectDiagnostics.ps1

Triggers the Intune "Collect diagnostics" remote action on selected devices and optionally waits for and downloads the resulting log package.

Microsoft IntuneDevices & remote actionsMakes changes · -WhatIf supported
Invoke-IntuneDeviceAction.ps1

Sends an Intune remote action (restart, remote lock, shut down, locate, lost mode, key/password rotation, Defender scan) to selected managed devices.

Microsoft IntuneDevices & remote actionsMakes changes · -WhatIf supported
Invoke-IntuneDeviceSync.ps1

Sends a bulk Intune "Sync" remote action to managed devices selected by name, platform, Entra group or all devices.

Microsoft IntuneDevices & remote actionsMakes changes · -WhatIf supportedWalkthrough
Invoke-IntuneDeviceWipe.ps1

Offboards selected Intune managed devices with Wipe, Retire, Autopilot Reset or Fresh Start, with a red summary and per-device confirmation.

Microsoft IntuneDevices & remote actionsMakes changes · -WhatIf supported
Rename-IntuneDevices.ps1

Renames selected Intune managed devices from a CSV mapping or a naming pattern with {SERIAL}, {SERIAL8}, {USER} and {OS} tokens.

Microsoft IntuneDevices & remote actionsMakes changes · -WhatIf supported
Set-IntuneDeviceCategoryBulk.ps1

Assigns an Intune device category to selected managed devices in bulk, skipping devices that already have it.

Microsoft IntuneDevices & remote actionsMakes changes · -WhatIf supported
Set-IntuneDevicePrimaryUser.ps1

Sets, clears or auto-assigns (from the last logged-on user) the Intune primary user of selected managed devices.

Microsoft IntuneDevices & remote actionsMakes changes · -WhatIf supported
Compare-IntunePolicyBackups.ps1

Compares two Intune policy backup folders created by Export-IntunePolicies.ps1 and reports added, removed and changed policies.

Microsoft IntuneCompliance, configuration & RBACReport only
Export-IntuneEndpointSecurityPolicies.ps1

Exports Intune Endpoint security policies (legacy template intents and settings catalog policies) with settings and assignments to JSON.

Microsoft IntuneCompliance, configuration & RBACReport only
Export-IntunePolicies.ps1

Exports Intune configuration, compliance, administrative template and platform script policies to JSON for backup and documentation.

Microsoft IntuneCompliance, configuration & RBACReport onlyWalkthrough
Export-IntuneRbacRoles.ps1

Exports Intune RBAC role definitions (permissions) and role assignments (admin groups, scope groups, scope tags) to JSON and CSV.

Microsoft IntuneCompliance, configuration & RBACReport only
Get-IntuneAssignmentFilters.ps1

Reports Intune assignment filters with their rules and which policies and apps use them in include or exclude mode.

Microsoft IntuneCompliance, configuration & RBACReport only
Get-IntuneCompliancePolicyStatusSummary.ps1

Per-policy compliance status summary (compliant, non-compliant, error, conflict, pending) for every Intune compliance policy.

Microsoft IntuneCompliance, configuration & RBACReport only
Get-IntuneConfigurationProfileStatus.ps1

Deployment status summary (succeeded, failed, error, conflict, pending) for Intune configuration profiles and administrative templates.

Microsoft IntuneCompliance, configuration & RBACReport only
Get-IntuneDevicePolicyReport.ps1

Reports every configuration profile, compliance policy and (optionally) detected app applied to one or more Intune devices.

Microsoft IntuneCompliance, configuration & RBACReport only
Get-IntuneScopeTagsReport.ps1

Reports Intune scope tags with their auto-assignment groups and how many policies and apps carry each tag.

Microsoft IntuneCompliance, configuration & RBACReport only
Get-IntuneUnusedPolicies.ps1

Finds Intune policies, scripts and (optionally) apps that are not assigned, or are assigned only to empty or deleted groups.

Microsoft IntuneCompliance, configuration & RBACReport only
Import-IntunePolicies.ps1

Restores Intune device configuration, compliance, settings catalog and platform script policies from an Export-IntunePolicies.ps1 backup.

Microsoft IntuneCompliance, configuration & RBACMakes changes · -WhatIf supported
Search-IntuneSettingsCatalog.ps1

Searches the Intune settings catalog for settings matching a keyword and reports their definition, category, platform and options.

Microsoft IntuneCompliance, configuration & RBACReport only
Export-IntuneAppConfigurationPolicies.ps1

Exports every Intune app configuration policy (managed devices and managed apps) to JSON plus a flattened CSV index.

Microsoft IntuneApps & app protectionReport only
Export-IntuneApps.ps1

Exports every Intune app with its assignments to one JSON file per app plus an Apps.csv inventory index.

Microsoft IntuneApps & app protectionReport only
Get-IntuneAppProtectionPolicies.ps1

Reports every Intune app protection (MAM) policy for iOS, Android and Windows with its key settings, targeted apps and assignments.

Microsoft IntuneApps & app protectionReport only
Get-IntuneAppProtectionStatus.ps1

Reports the app protection (MAM) status of every managed app registration: user, app, device, last sync, flags and policy gaps.

Microsoft IntuneApps & app protectionReport only
Get-IntuneAppRelationships.ps1

Reports Win32 app dependencies and supersedence relationships and flags superseded apps that are still assigned.

Microsoft IntuneApps & app protectionReport only
Disable-EntraUserOffboarding.ps1

Offboards user identities: disables the account, revokes sessions, resets the password, removes groups, manager, licenses and MFA methods.

Microsoft Entra IDUsers & authenticationMakes changes · -WhatIf supported
Get-EntraDeletedUsers.ps1

Reports soft-deleted users with the days left before permanent deletion, and optionally restores or permanently deletes them.

Microsoft Entra IDUsers & authenticationRead-only unless you add a switch
Get-EntraInactiveUsers.ps1

Reports member accounts with no sign-in for a number of days (or ever) and optionally disables them or revokes their sessions.

Microsoft Entra IDUsers & authenticationRead-only unless you add a switch
Get-EntraPasswordExpiryReport.ps1

Reports when cloud user passwords expire, based on the domain password validity period and each user's last password change.

Microsoft Entra IDUsers & authenticationReport only
Get-EntraStaleGuestUsers.ps1

Finds guest accounts that never signed in, have been inactive for a number of days, or never accepted their invitation.

Microsoft Entra IDUsers & authenticationRead-only unless you add a switchWalkthrough
Get-EntraUserAuthenticationMethods.ps1

Reports the registered authentication methods (Authenticator, phone, FIDO2, Windows Hello, TAP, etc.) of users and flags password-only accounts.

Microsoft Entra IDUsers & authenticationReport only
Get-EntraUserInventory.ps1

Exports an inventory of Microsoft Entra ID users with licence count, manager, last sign-in and password age.

Microsoft Entra IDUsers & authenticationReport only
New-EntraTemporaryAccessPass.ps1

Issues Temporary Access Passes (TAP) for one or more users, within the limits of the tenant's TAP policy.

Microsoft Entra IDUsers & authenticationMakes changes · -WhatIf supported
New-EntraUsersFromCsv.ps1

Creates Microsoft Entra ID users in bulk from a CSV file, with optional manager, group memberships and license assignment.

Microsoft Entra IDUsers & authenticationMakes changes · -WhatIf supported
Reset-EntraUserMfa.ps1

Removes all registered MFA / passwordless methods of a user so they must re-register, optionally issuing a Temporary Access Pass.

Microsoft Entra IDUsers & authenticationMakes changes · -WhatIf supported
Set-EntraUserAttributesFromCsv.ps1

Bulk-updates user profile attributes (job title, department, address, phones, employee data and more) from a CSV file.

Microsoft Entra IDUsers & authenticationMakes changes · -WhatIf supported
Add-EntraGroupMembersFromCsv.ps1

Adds or removes Microsoft Entra ID group members in bulk from a CSV file.

Microsoft Entra IDGroupsMakes changes · -WhatIf supported
Compare-EntraGroupMembership.ps1

Compares the membership of two Microsoft Entra ID groups (or a group and a CSV list of UPNs) and can synchronise them.

Microsoft Entra IDGroupsRead-only unless you add a switch
Export-EntraGroupMembership.ps1

Exports the members (direct or transitive) or the owners of one, several or all Microsoft Entra ID groups to CSV.

Microsoft Entra IDGroupsReport only
Get-EntraDynamicGroupRules.ps1

Reports every dynamic membership group in Microsoft Entra ID with its rule, processing state and last evaluation status.

Microsoft Entra IDGroupsReport only
Get-EntraGroupInventory.ps1

Inventories every Microsoft Entra ID group with its resolved type, dynamic rule, Teams status and optional member/owner counts.

Microsoft Entra IDGroupsReport only
Get-EntraGroupsWithGuests.ps1

Reports Microsoft Entra ID groups (and Teams) that contain guest users, with guest counts, guest domains and owners.

Microsoft Entra IDGroupsReport only
Get-EntraNestedGroupsReport.ps1

Reports nested group membership in Microsoft Entra ID (groups that contain other groups), including circular references.

Microsoft Entra IDGroupsReport only
Get-EntraOwnerlessAndEmptyGroups.ps1

Finds groups without owners and/or without members, and can assign an owner to the ownerless ones.

Microsoft Entra IDGroupsRead-only unless you add a switch
Get-EntraDeviceInventory.ps1

Exports an inventory of the device objects in Microsoft Entra ID with join type, management, compliance and owner details.

Microsoft Entra IDDevicesReport only
Get-EntraStaleDevices.ps1

Finds Microsoft Entra ID devices that have not signed in for a number of days and can disable or remove them.

Microsoft Entra IDDevicesRead-only unless you add a switch
Get-PurviewIRMConfiguration.ps1

Audits the Exchange Online IRM / Azure Rights Management configuration against recommended values.

Microsoft PurviewInformation protectionRead-only unless you add a switch
Get-PurviewLabelHierarchy.ps1

Prints the sensitivity label tree (parents and sub-labels) and exports it with publishing status to CSV.

Microsoft PurviewInformation protectionReport only
Get-PurviewLabelPolicySettings.ps1

Builds a settings matrix of every sensitivity label policy (mandatory labeling, default labels, scopes, distribution).

Microsoft PurviewInformation protectionReport only
Get-PurviewLabelUsageFromAudit.ps1

Reports sensitivity label activity (applied, changed, removed) from the unified audit log.

Microsoft PurviewInformation protectionReport only
Get-PurviewOMEConfiguration.ps1

Documents Microsoft Purview Message Encryption (OME) branding templates and the transport rules that use them.

Microsoft PurviewInformation protectionRead-only unless you add a switch
Import-PurviewSensitivityLabels.ps1

Bulk-creates Microsoft Purview sensitivity labels from a CSV file and optionally publishes them in a label policy.

Microsoft PurviewInformation protectionMakes changes · -WhatIf supported
New-PurviewCustomSensitiveInfoType.ps1

Builds a Purview rule package XML for a custom sensitive information type and optionally uploads it.

Microsoft PurviewInformation protectionRead-only unless you add a switch
Test-PurviewSensitiveInfoType.ps1

Tests which Purview sensitive information types match a text or plain-text file, or lists the available types.

Microsoft PurviewInformation protectionReport only
Export-PurviewDlpRulesMatrix.ps1

Exports a one-row-per-rule matrix of all Purview DLP rules with their conditions, exceptions and actions.

Microsoft PurviewData loss preventionReport only
Get-PurviewDlpAlertsViaGraph.ps1

Lists Microsoft Purview DLP alerts through the Microsoft Graph security API and optionally resolves them.

Microsoft PurviewData loss preventionRead-only unless you add a switch
Get-PurviewDlpIncidentsFromAudit.ps1

Reports Purview DLP rule matches from the unified audit log for Exchange, SharePoint/OneDrive and endpoint devices.

Microsoft PurviewData loss preventionReport only
Get-PurviewDlpPolicyHealth.ps1

Checks every Purview DLP policy for configuration problems and reports findings with a severity.

Microsoft PurviewData loss preventionReport only
Get-PurviewEdmSchemas.ps1

Reports exact data match (EDM) schemas, their fields and the EDM sensitive information types that use them.

Microsoft PurviewData loss preventionReport only
Get-PurviewEndpointDlpSettings.ps1

Documents the tenant-wide Endpoint DLP settings (exclusions, restricted apps and browsers, service domains, device groups).

Microsoft PurviewData loss preventionReport only
Get-PurviewSensitiveInfoTypes.ps1

Inventories sensitive information types (SITs), their rule packages and the DLP / auto-labeling rules that use them.

Microsoft PurviewData loss preventionReport only
Set-PurviewDlpPolicyMode.ps1

Switches Purview DLP policies between test and enforcement modes, in bulk and with a before/after report.

Microsoft PurviewData loss preventionMakes changes · -WhatIf supported
Export-PurviewRetentionLabels.ps1

Documents Microsoft Purview retention labels, their file plan descriptors and where each label is published or auto-applied.

Microsoft PurviewRetention & records managementReport only
Export-PurviewRetentionPolicies.ps1

Documents Microsoft Purview retention policies and their retention rules to CSV and JSON.

Microsoft PurviewRetention & records managementReport only
Get-PurviewAdaptiveScopes.ps1

Reports Microsoft Purview adaptive scopes, their queries and the retention policies that use them.

Microsoft PurviewRetention & records management
Add-TeamsMembers.ps1

Adds users to teams as owners or members (or removes them) from a CSV file or from parameters, skipping existing memberships.

Teams, SharePoint & OneDriveTeams inventory & lifecycleMakes changes · -WhatIf supported
Export-TeamsMembership.ps1

Exports the membership of all or selected teams, one row per member with the role Owner, Member or Guest.

Teams, SharePoint & OneDriveTeams inventory & lifecycleReport only
Get-TeamsAllTeamsReport.ps1

Inventories every Microsoft Teams team with owner, member, guest and channel counts, archive state and age.

Teams, SharePoint & OneDriveTeams inventory & lifecycleReport only
Get-TeamsArchivedTeams.ps1

Lists archived Microsoft Teams teams and can unarchive them or delete them (with their Microsoft 365 group).

Teams, SharePoint & OneDriveTeams inventory & lifecycleRead-only unless you add a switch
Get-TeamsChannelsReport.ps1

Lists every channel of every team (standard, private, shared) with type, age, email, archive state and optional file size.

Teams, SharePoint & OneDriveTeams inventory & lifecycleReport only
Get-TeamsGuestAccessReport.ps1

Reports which Microsoft Teams teams contain guest users and which external domains they come from.

Teams, SharePoint & OneDriveTeams inventory & lifecycleReport onlyWalkthrough
Get-TeamsInactiveTeams.ps1

Finds Microsoft Teams teams that nobody uses, based on the Teams team activity usage report.

Teams, SharePoint & OneDriveTeams inventory & lifecycleReport onlyWalkthrough
Get-TeamsOwnerlessTeams.ps1

Finds teams with no owner, with only disabled owners or with a single owner, and can assign a new owner.

Teams, SharePoint & OneDriveTeams inventory & lifecycleRead-only unless you add a switch
Get-TeamsPrivateAndSharedChannelsReport.ps1

Reports private and shared channels with their owner, member, guest and external member counts and sharing targets.

Teams, SharePoint & OneDriveTeams inventory & lifecycleReport only
Get-TeamsUserMembership.ps1

Lists the teams one or more users belong to, with their role (Owner, Member, Guest) and the team's visibility and archive state.

Teams, SharePoint & OneDriveTeams inventory & lifecycleReport only
Invoke-TeamsArchiveInactiveTeams.ps1

Reports teams with no activity for N days and, on request, notifies their owners and archives them.

Teams, SharePoint & OneDriveTeams inventory & lifecycleRead-only unless you add a switch
Remove-TeamsUserFromAllTeams.ps1

Offboarding helper: lists every team a user belongs to and, with -Remove, removes the user from all of them.

Teams, SharePoint & OneDriveTeams inventory & lifecycleRead-only unless you add a switch
Get-TeamsAppCatalogReport.ps1

Reports the Microsoft Teams app catalog: organisation (custom) apps with their versions and publishing state, optionally store and sideloaded apps.

Teams, SharePoint & OneDriveTeams apps, settings & usageReport only
Get-TeamsDeviceUsageReport.ps1

Reports which Teams client platforms (Windows, Mac, web, iOS, Android, ...) every user has used and finds web-only and mobile-only users.

Teams, SharePoint & OneDriveTeams apps, settings & usageReport only
Get-TeamsInstalledApps.ps1

Inventories the apps installed in Microsoft Teams teams, with version, distribution method and bot flag.

Teams, SharePoint & OneDriveTeams apps, settings & usageReport only
Get-TeamsRoomsAndPlaces.ps1

Inventories meeting rooms (places) with capacity, location, AV devices and room list membership, and flags incomplete room metadata.

Teams, SharePoint & OneDriveTeams apps, settings & usageReport only
Get-TeamsTagsReport.ps1

Reports the tags defined in Microsoft Teams teams (and their members) and can bulk-create tags from a CSV.

Teams, SharePoint & OneDriveTeams apps, settings & usageRead-only unless you add a switch
Get-TeamsTeamSettingsReport.ps1

Reports the member, guest, messaging, fun and discovery settings of Microsoft Teams teams and flags deviations from the defaults.

Teams, SharePoint & OneDriveTeams apps, settings & usageReport only
Get-TeamsUserActivityReport.ps1

Reports Microsoft Teams activity per user (messages, calls, meetings, media minutes) and flags inactive and licensed-but-inactive users.

Teams, SharePoint & OneDriveTeams apps, settings & usageReport only
New-TeamsFromCsv.ps1

Creates Microsoft Teams teams in bulk from a CSV file, including owners, members and channels.

Teams, SharePoint & OneDriveTeams apps, settings & usageMakes changes · -WhatIf supported
Set-TeamsGuestSettings.ps1

Standardises guest permissions (and optionally member and fun settings) across Microsoft Teams teams.

Teams, SharePoint & OneDriveTeams apps, settings & usageMakes changes · -WhatIf supported
Export-TeamsPolicies.ps1

Exports every Teams policy and tenant configuration definition to JSON and compares the export with a previous one.

Teams, SharePoint & OneDriveTeams administration (MicrosoftTeams module)Report only
Get-TeamsAppPolicies.ps1

Reports the Teams app permission and app setup policies, the org-wide custom app setting and how many users each policy has.

Teams, SharePoint & OneDriveTeams administration (MicrosoftTeams module)Report only
Get-TeamsCallQueuesAndAutoAttendants.ps1

Documents every Teams call queue, auto attendant and voice application resource account, with configuration gaps flagged.

Teams, SharePoint & OneDriveTeams administration (MicrosoftTeams module)Report only
Get-TeamsExternalAccessConfiguration.ps1

Reviews the tenant-wide Teams external access, guest access and anonymous meeting settings against recommended values.

Teams, SharePoint & OneDriveTeams administration (MicrosoftTeams module)Report only
Get-TeamsMeetingSettingsReport.ps1

Reports the security and feature settings of every Teams meeting policy plus the tenant meeting configuration.

Teams, SharePoint & OneDriveTeams administration (MicrosoftTeams module)Report only
Get-TeamsPhoneNumberInventory.ps1

Inventories every Teams phone number with its type, assignment, capabilities, location and PSTN partner.

Teams, SharePoint & OneDriveTeams administration (MicrosoftTeams module)Report only
Get-TeamsUserPolicyAssignments.ps1

Reports the Teams policies directly assigned to each user, finds who has a given policy and optionally exports group assignments.

Teams, SharePoint & OneDriveTeams administration (MicrosoftTeams module)Report only
Get-TeamsVoiceEnabledUsers.ps1

Reports Enterprise Voice enabled Teams users with their phone number, voice policies, licensing and configuration gaps.

Teams, SharePoint & OneDriveTeams administration (MicrosoftTeams module)Report only
Grant-TeamsPolicies.ps1

Bulk-assigns Teams policies to users (one by one or as batch operations) or to a group, with validation and a preview mode.

Teams, SharePoint & OneDriveTeams administration (MicrosoftTeams module)Makes changes · -WhatIf supported
Add-SPOSiteCollectionAdmin.ps1

Grants (or with -Remove revokes) site collection administrator rights for an account on selected SharePoint Online sites or OneDrives.

Teams, SharePoint & OneDriveSharePoint administration (SPO module)Makes changes · -WhatIf supported
Export-SPOTenantSettings.ps1

Exports all SharePoint Online tenant settings to JSON, assesses the key sharing and security settings and diffs against an earlier export.

Teams, SharePoint & OneDriveSharePoint administration (SPO module)Report only
Get-SPODeletedSitesReport.ps1

Reports the SharePoint Online sites in the tenant recycle bin with their remaining retention, and optionally restores or purges them.

Teams, SharePoint & OneDriveSharePoint administration (SPO module)Read-only unless you add a switch
Convert-M365DirectLicensesToGroup.ps1

Migrates direct license assignments of one SKU to group-based licensing without interrupting the users' service.

Microsoft 365 tenantLicensingRead-only unless you add a switch
Export-M365SkuCatalog.ps1

Exports the tenant's SKU catalog (with friendly names and consumption) and the service plans inside every SKU.

Microsoft 365 tenantLicensingReport only
Get-M365CopilotLicenseReport.ps1

Reports Microsoft 365 Copilot license consumption, every licensed user and, optionally, their Copilot usage per app.

Microsoft 365 tenantLicensingReport only
Get-M365GroupBasedLicensingErrors.ps1

Lists every group that assigns licenses, its processing state and the members whose group-based assignment failed.

Microsoft 365 tenantLicensingRead-only unless you add a switch
Get-M365LicenseAssignmentPaths.ps1

Reports how every licensed user received each SKU (direct, group-based or both) together with assignment errors.

Microsoft 365 tenantLicensingReport only
Get-M365LicenseChangesAudit.ps1

Reports who added or removed which licenses for which users, from the Microsoft Entra directory audit log.

Microsoft 365 tenantLicensingReport only
Get-M365LicenseReport.ps1

Reports Microsoft 365 license consumption per SKU and, optionally, licensed users whose licenses could be reclaimed.

Microsoft 365 tenantLicensingReport onlyWalkthrough
Get-M365ServicePlanReport.ps1

Reports the service plans inside every subscribed SKU and, per user, which plans are disabled or not provisioned.

Microsoft 365 tenantLicensingReport only
Get-M365SubscriptionsReport.ps1

Reports every commercial subscription of the tenant with status, trial flag, renewal/expiry date and SKU consumption.

Microsoft 365 tenantLicensingReport only
Get-M365UsageLocationReport.ps1

Finds member users without a usage location, suggests one from their country attribute and optionally sets it.

Microsoft 365 tenantLicensingRead-only unless you add a switch
Set-M365UserLicenses.ps1

Assigns and removes Microsoft 365 licenses for one user or a CSV of users, with pre-flight checks and a results CSV.

Microsoft 365 tenantLicensingMakes changes · -WhatIf supported
Export-M365UsageReportsBundle.ps1

Downloads a bundle of Microsoft 365 usage detail reports (users, mailboxes, apps, OneDrive, SharePoint, Teams, groups, Viva Engage, activations) as CSV files.

Microsoft 365 tenantUsage & adoption reportsReport only
Get-M365ActivationsReport.ps1

Reports Microsoft 365 Apps, Project and Visio activations per user and device platform from the Graph usage reports.

Microsoft 365 tenantUsage & adoption reportsReport only
Get-M365ActiveUsersReport.ps1

Reports Microsoft 365 user activity per workload from the Graph usage reports and flags inactive licensed users.

Microsoft 365 tenantUsage & adoption reportsReport only
Get-M365AppsUsageReport.ps1

Reports which Microsoft 365 Apps (Outlook, Word, Excel, PowerPoint, OneNote, Teams) and platforms each user actually uses.

Microsoft 365 tenantUsage & adoption reportsReport only
Get-M365EmailActivityReport.ps1

Reports Exchange Online email activity per user (sent, received, read, meetings) from the Graph usage reports.

Microsoft 365 tenantUsage & adoption reportsReport only
Get-M365GroupsActivityReport.ps1

Reports Microsoft 365 group activity, membership, guests, owners and storage from the Graph usage reports.

Microsoft 365 tenantUsage & adoption reportsReport only
Get-M365MailboxUsageReport.ps1

Reports Exchange Online mailbox sizes, quotas and archive adoption from the Graph usage reports (no Exchange module needed).

Microsoft 365 tenantUsage & adoption reportsReport only
Get-M365OneDriveActivityReport.ps1

Reports OneDrive for Business user activity, sync adoption and external sharing from the Graph usage reports.

Microsoft 365 tenantUsage & adoption reportsReport only
Get-M365VivaEngageActivityReport.ps1

Reports Viva Engage (Yammer) user activity, communities and device usage from the Graph usage reports.

Microsoft 365 tenantUsage & adoption reportsReport only
Get-M365WorkloadAdoptionSummary.ps1

Summarises Microsoft 365 adoption per workload (active vs inactive users and the daily active-user trend) from the Graph usage reports.

Microsoft 365 tenantUsage & adoption reportsReport only
Export-M365TenantSettingsSnapshot.ps1

Exports a JSON snapshot of tenant-wide Microsoft 365 settings and diffs it against a previous snapshot for change tracking.

Microsoft 365 tenantTenant configuration & healthReport only
Get-M365DomainsReport.ps1

Reports every domain in the tenant with verification, authentication type, services and password policy, plus DNS and federation details.

Microsoft 365 tenantTenant configuration & healthReport only
Get-DefenderSecureScore.ps1

Shows the current Microsoft Secure Score and the improvement actions with the largest remaining point gap.

Microsoft DefenderDocumented on this siteReport onlyWalkthrough
51 more Microsoft Defender scripts on GitHub

The complete, documented list for this folder — with what each script does, the permissions it needs and whether it changes anything — is in the folder README on GitHub.

Microsoft Defender54 scripts in this folder
50 more Exchange Online scripts on GitHub

The complete, documented list for this folder — with what each script does, the permissions it needs and whether it changes anything — is in the folder README on GitHub.

Exchange Online53 scripts in this folder
How they're built

Design principles behind every script

Read-only by default

A script only changes something when you pass an explicit switch such as -RetireDevices or -Remediate. Every change supports -WhatIf and -Confirm.

Least privilege

Each script requests only the Graph scopes or admin roles it needs and lists them in its help and in the folder README.

Current tooling

Microsoft Graph PowerShell SDK (v1.0 where possible) and Exchange Online PowerShell V3. No retired AzureAD or MSOnline modules.

Windows PowerShell 5.1 and PowerShell 7

No PowerShell 7-only syntax, so the scripts run wherever your admins already work.

Self-documenting

Get-Help .\Script.ps1 -Full works everywhere. Reports land in .\Reports\ as timestamped CSV files; add -PassThru to keep working with the objects.

Consistent

Same parameter names (-OutputPath, -PassThru, -DaysInactive, -InputCsv), same helpers, same summary style — learn one script and you know them all.

Before you run anything: read the script's help (Get-Help .\Script.ps1 -Full), check the permissions it requests, and try it in a test tenant or with -WhatIf first. The scripts are published under the MIT licence — use them, adapt them, and send improvements back through GitHub.

Suggest a topic

Need a script you don't see here?

Tell me which report or clean-up task you'd like automated, and it may become the next addition to the repository.