Get-IntuneStaleDevices.ps1
Reports Intune managed devices that have not synced for a given number of days and can optionally retire or delete them.
Documented, read-only-by-default scripts for Intune, Entra ID, Defender, Exchange Online, Purview, Teams, SharePoint and tenant administration — the questions admins ask most often ("which devices stopped syncing?", "who forwards mail outside the company?", "which teams are dead?", "how many licences are we wasting?") turned into repeatable tools built on Microsoft Graph and Exchange Online PowerShell V3. Open source under the MIT licence.
The download is the complete repository as a .zip file, generated by GitHub from the latest version of github.com/omer-eltayeb/M365.
Parameters, examples, permissions and the full source, explained on this site.
Get-IntuneStaleDevices.ps1Reports Intune managed devices that have not synced for a given number of days and can optionally retire or delete them.
Get-AutopilotDeviceReport.ps1Windows Autopilot registration health report: profile assignment status, enrollment state and last contact per device.
Export-EntraConditionalAccessPolicies.ps1Backs up every Conditional Access policy to JSON and builds a human-readable CSV summary.
Get-EXOExternalForwardingReport.ps1Finds mail leaving the tenant through mailbox forwarding or inbox rules, and optionally removes it.
Get-IntunePolicyAssignments.ps1Builds a "who gets what" assignment matrix for Intune policies and (optionally) apps.
Get-EntraMFARegistrationReport.ps1Reports the MFA, passwordless and SSPR registration posture of users in Microsoft Entra ID.
Every script in the repository, with what it does and whether it changes anything. Each name opens the script on GitHub.
Showing all 365 scripts
Get-IntuneBitLockerRecoveryKeys.ps1Inventories the BitLocker recovery keys escrowed in Entra ID, joined to the owning device, optionally including the key material for selected devices.
Get-IntuneDeviceComplianceReport.ps1Inventory and compliance report for all Intune managed devices.
Get-IntuneDeviceHardwareInventory.ps1Builds a per-device hardware inventory (storage, memory, TPM, BIOS, battery, network) for Intune managed devices.
Get-IntuneDevicesPerUser.ps1Groups Intune managed devices by primary user and reports users who own an unusually high number of devices.
Get-IntuneEncryptionReport.ps1Reports the encryption state of Intune managed devices and, optionally, whether Windows devices have a BitLocker recovery key escrowed in Entra ID.
Get-IntuneLapsPasswords.ps1Reports Windows LAPS password backups in Entra ID, flags stale or overdue backups and optionally retrieves the current local administrator password.
Get-IntuneOrphanedDevices.ps1Reports Intune managed devices whose primary user is missing, deleted from Entra ID or disabled.
Get-IntuneStaleDevices.ps1Reports Intune managed devices that have not synced for a given number of days and can optionally retire or delete them.
Invoke-IntuneCollectDiagnostics.ps1Triggers the Intune "Collect diagnostics" remote action on selected devices and optionally waits for and downloads the resulting log package.
Invoke-IntuneDeviceAction.ps1Sends an Intune remote action (restart, remote lock, shut down, locate, lost mode, key/password rotation, Defender scan) to selected managed devices.
Invoke-IntuneDeviceSync.ps1Sends a bulk Intune "Sync" remote action to managed devices selected by name, platform, Entra group or all devices.
Invoke-IntuneDeviceWipe.ps1Offboards selected Intune managed devices with Wipe, Retire, Autopilot Reset or Fresh Start, with a red summary and per-device confirmation.
Rename-IntuneDevices.ps1Renames selected Intune managed devices from a CSV mapping or a naming pattern with {SERIAL}, {SERIAL8}, {USER} and {OS} tokens.
Set-IntuneDeviceCategoryBulk.ps1Assigns an Intune device category to selected managed devices in bulk, skipping devices that already have it.
Set-IntuneDevicePrimaryUser.ps1Sets, clears or auto-assigns (from the last logged-on user) the Intune primary user of selected managed devices.
Compare-IntunePolicyBackups.ps1Compares two Intune policy backup folders created by Export-IntunePolicies.ps1 and reports added, removed and changed policies.
Export-IntuneEndpointSecurityPolicies.ps1Exports Intune Endpoint security policies (legacy template intents and settings catalog policies) with settings and assignments to JSON.
Export-IntunePolicies.ps1Exports Intune configuration, compliance, administrative template and platform script policies to JSON for backup and documentation.
Export-IntuneRbacRoles.ps1Exports Intune RBAC role definitions (permissions) and role assignments (admin groups, scope groups, scope tags) to JSON and CSV.
Get-IntuneAssignmentFilters.ps1Reports Intune assignment filters with their rules and which policies and apps use them in include or exclude mode.
Get-IntuneCompliancePolicyStatusSummary.ps1Per-policy compliance status summary (compliant, non-compliant, error, conflict, pending) for every Intune compliance policy.
Get-IntuneConfigurationProfileStatus.ps1Deployment status summary (succeeded, failed, error, conflict, pending) for Intune configuration profiles and administrative templates.
Get-IntuneDevicePolicyReport.ps1Reports every configuration profile, compliance policy and (optionally) detected app applied to one or more Intune devices.
Get-IntuneNoncompliantDeviceDetails.ps1Reports the setting-level reasons why Intune managed devices are non-compliant.
Get-IntunePolicyAssignments.ps1Builds a "who gets what" assignment matrix for Intune policies and (optionally) apps.
Get-IntuneScopeTagsReport.ps1Reports Intune scope tags with their auto-assignment groups and how many policies and apps carry each tag.
Get-IntuneUnusedPolicies.ps1Finds Intune policies, scripts and (optionally) apps that are not assigned, or are assigned only to empty or deleted groups.
Import-IntunePolicies.ps1Restores Intune device configuration, compliance, settings catalog and platform script policies from an Export-IntunePolicies.ps1 backup.
Search-IntuneSettingsCatalog.ps1Searches the Intune settings catalog for settings matching a keyword and reports their definition, category, platform and options.
Export-IntuneAppConfigurationPolicies.ps1Exports every Intune app configuration policy (managed devices and managed apps) to JSON plus a flattened CSV index.
Export-IntuneApps.ps1Exports every Intune app with its assignments to one JSON file per app plus an Apps.csv inventory index.
Get-IntuneAppInstallStatus.ps1Install status overview (installed / failed / pending / not applicable) for every assigned Intune app.
Get-IntuneAppProtectionPolicies.ps1Reports every Intune app protection (MAM) policy for iOS, Android and Windows with its key settings, targeted apps and assignments.
Get-IntuneAppProtectionStatus.ps1Reports the app protection (MAM) status of every managed app registration: user, app, device, last sync, flags and policy gaps.
Get-IntuneAppRelationships.ps1Reports Win32 app dependencies and supersedence relationships and flags superseded apps that are still assigned.
Disable-EntraUserOffboarding.ps1Offboards user identities: disables the account, revokes sessions, resets the password, removes groups, manager, licenses and MFA methods.
Get-EntraDeletedUsers.ps1Reports soft-deleted users with the days left before permanent deletion, and optionally restores or permanently deletes them.
Get-EntraInactiveUsers.ps1Reports member accounts with no sign-in for a number of days (or ever) and optionally disables them or revokes their sessions.
Get-EntraMFARegistrationReport.ps1Reports the MFA, passwordless and SSPR registration posture of users in Microsoft Entra ID.
Get-EntraPasswordExpiryReport.ps1Reports when cloud user passwords expire, based on the domain password validity period and each user's last password change.
Get-EntraStaleGuestUsers.ps1Finds guest accounts that never signed in, have been inactive for a number of days, or never accepted their invitation.
Get-EntraUserAuthenticationMethods.ps1Reports the registered authentication methods (Authenticator, phone, FIDO2, Windows Hello, TAP, etc.) of users and flags password-only accounts.
Get-EntraUserInventory.ps1Exports an inventory of Microsoft Entra ID users with licence count, manager, last sign-in and password age.
New-EntraTemporaryAccessPass.ps1Issues Temporary Access Passes (TAP) for one or more users, within the limits of the tenant's TAP policy.
New-EntraUsersFromCsv.ps1Creates Microsoft Entra ID users in bulk from a CSV file, with optional manager, group memberships and license assignment.
Reset-EntraUserMfa.ps1Removes all registered MFA / passwordless methods of a user so they must re-register, optionally issuing a Temporary Access Pass.
Set-EntraUserAttributesFromCsv.ps1Bulk-updates user profile attributes (job title, department, address, phones, employee data and more) from a CSV file.
Add-EntraGroupMembersFromCsv.ps1Adds or removes Microsoft Entra ID group members in bulk from a CSV file.
Compare-EntraGroupMembership.ps1Compares the membership of two Microsoft Entra ID groups (or a group and a CSV list of UPNs) and can synchronise them.
Export-EntraGroupMembership.ps1Exports the members (direct or transitive) or the owners of one, several or all Microsoft Entra ID groups to CSV.
Get-EntraDynamicGroupRules.ps1Reports every dynamic membership group in Microsoft Entra ID with its rule, processing state and last evaluation status.
Get-EntraGroupInventory.ps1Inventories every Microsoft Entra ID group with its resolved type, dynamic rule, Teams status and optional member/owner counts.
Get-EntraGroupsWithGuests.ps1Reports Microsoft Entra ID groups (and Teams) that contain guest users, with guest counts, guest domains and owners.
Get-EntraNestedGroupsReport.ps1Reports nested group membership in Microsoft Entra ID (groups that contain other groups), including circular references.
Get-EntraOwnerlessAndEmptyGroups.ps1Finds groups without owners and/or without members, and can assign an owner to the ownerless ones.
Get-EntraDeviceInventory.ps1Exports an inventory of the device objects in Microsoft Entra ID with join type, management, compliance and owner details.
Get-EntraStaleDevices.ps1Finds Microsoft Entra ID devices that have not signed in for a number of days and can disable or remove them.
Export-PurviewSensitivityLabels.ps1Documents Microsoft Purview sensitivity labels and label policies to CSV and JSON.
Get-PurviewAutoLabelingPolicies.ps1Documents Microsoft Purview auto-labeling policies and their rules to CSV and JSON.
Get-PurviewIRMConfiguration.ps1Audits the Exchange Online IRM / Azure Rights Management configuration against recommended values.
Get-PurviewLabelHierarchy.ps1Prints the sensitivity label tree (parents and sub-labels) and exports it with publishing status to CSV.
Get-PurviewLabelPolicySettings.ps1Builds a settings matrix of every sensitivity label policy (mandatory labeling, default labels, scopes, distribution).
Get-PurviewLabelUsageFromAudit.ps1Reports sensitivity label activity (applied, changed, removed) from the unified audit log.
Get-PurviewOMEConfiguration.ps1Documents Microsoft Purview Message Encryption (OME) branding templates and the transport rules that use them.
Import-PurviewSensitivityLabels.ps1Bulk-creates Microsoft Purview sensitivity labels from a CSV file and optionally publishes them in a label policy.
New-PurviewCustomSensitiveInfoType.ps1Builds a Purview rule package XML for a custom sensitive information type and optionally uploads it.
Test-PurviewSensitiveInfoType.ps1Tests which Purview sensitive information types match a text or plain-text file, or lists the available types.
Export-PurviewDLPPolicies.ps1Documents Microsoft Purview DLP policies and their rules to CSV and JSON.
Export-PurviewDlpRulesMatrix.ps1Exports a one-row-per-rule matrix of all Purview DLP rules with their conditions, exceptions and actions.
Get-PurviewDlpAlertsViaGraph.ps1Lists Microsoft Purview DLP alerts through the Microsoft Graph security API and optionally resolves them.
Get-PurviewDlpIncidentsFromAudit.ps1Reports Purview DLP rule matches from the unified audit log for Exchange, SharePoint/OneDrive and endpoint devices.
Get-PurviewDlpOverridesAndFalsePositives.ps1Reports DLP policy-tip overrides and false-positive reports from the unified audit log and highlights rules that need tuning.
Get-PurviewDlpPolicyHealth.ps1Checks every Purview DLP policy for configuration problems and reports findings with a severity.
Get-PurviewEdmSchemas.ps1Reports exact data match (EDM) schemas, their fields and the EDM sensitive information types that use them.
Get-PurviewEndpointDlpSettings.ps1Documents the tenant-wide Endpoint DLP settings (exclusions, restricted apps and browsers, service domains, device groups).
Get-PurviewSensitiveInfoTypes.ps1Inventories sensitive information types (SITs), their rule packages and the DLP / auto-labeling rules that use them.
Set-PurviewDlpPolicyMode.ps1Switches Purview DLP policies between test and enforcement modes, in bulk and with a before/after report.
Export-PurviewRetentionLabels.ps1Documents Microsoft Purview retention labels, their file plan descriptors and where each label is published or auto-applied.
Export-PurviewRetentionPolicies.ps1Documents Microsoft Purview retention policies and their retention rules to CSV and JSON.
Get-PurviewAdaptiveScopes.ps1Reports Microsoft Purview adaptive scopes, their queries and the retention policies that use them.
Add-TeamsMembers.ps1Adds users to teams as owners or members (or removes them) from a CSV file or from parameters, skipping existing memberships.
Export-TeamsMembership.ps1Exports the membership of all or selected teams, one row per member with the role Owner, Member or Guest.
Get-TeamsAllTeamsReport.ps1Inventories every Microsoft Teams team with owner, member, guest and channel counts, archive state and age.
Get-TeamsArchivedTeams.ps1Lists archived Microsoft Teams teams and can unarchive them or delete them (with their Microsoft 365 group).
Get-TeamsChannelsReport.ps1Lists every channel of every team (standard, private, shared) with type, age, email, archive state and optional file size.
Get-TeamsGuestAccessReport.ps1Reports which Microsoft Teams teams contain guest users and which external domains they come from.
Get-TeamsInactiveTeams.ps1Finds Microsoft Teams teams that nobody uses, based on the Teams team activity usage report.
Get-TeamsOwnerlessTeams.ps1Finds teams with no owner, with only disabled owners or with a single owner, and can assign a new owner.
Get-TeamsPrivateAndSharedChannelsReport.ps1Reports private and shared channels with their owner, member, guest and external member counts and sharing targets.
Get-TeamsUserMembership.ps1Lists the teams one or more users belong to, with their role (Owner, Member, Guest) and the team's visibility and archive state.
Invoke-TeamsArchiveInactiveTeams.ps1Reports teams with no activity for N days and, on request, notifies their owners and archives them.
Remove-TeamsUserFromAllTeams.ps1Offboarding helper: lists every team a user belongs to and, with -Remove, removes the user from all of them.
Get-TeamsAppCatalogReport.ps1Reports the Microsoft Teams app catalog: organisation (custom) apps with their versions and publishing state, optionally store and sideloaded apps.
Get-TeamsDeviceUsageReport.ps1Reports which Teams client platforms (Windows, Mac, web, iOS, Android, ...) every user has used and finds web-only and mobile-only users.
Get-TeamsInstalledApps.ps1Inventories the apps installed in Microsoft Teams teams, with version, distribution method and bot flag.
Get-TeamsRoomsAndPlaces.ps1Inventories meeting rooms (places) with capacity, location, AV devices and room list membership, and flags incomplete room metadata.
Get-TeamsTagsReport.ps1Reports the tags defined in Microsoft Teams teams (and their members) and can bulk-create tags from a CSV.
Get-TeamsTeamSettingsReport.ps1Reports the member, guest, messaging, fun and discovery settings of Microsoft Teams teams and flags deviations from the defaults.
Get-TeamsUserActivityReport.ps1Reports Microsoft Teams activity per user (messages, calls, meetings, media minutes) and flags inactive and licensed-but-inactive users.
New-TeamsFromCsv.ps1Creates Microsoft Teams teams in bulk from a CSV file, including owners, members and channels.
Set-TeamsGuestSettings.ps1Standardises guest permissions (and optionally member and fun settings) across Microsoft Teams teams.
Export-TeamsPolicies.ps1Exports every Teams policy and tenant configuration definition to JSON and compares the export with a previous one.
Get-TeamsAppPolicies.ps1Reports the Teams app permission and app setup policies, the org-wide custom app setting and how many users each policy has.
Get-TeamsCallQueuesAndAutoAttendants.ps1Documents every Teams call queue, auto attendant and voice application resource account, with configuration gaps flagged.
Get-TeamsExternalAccessConfiguration.ps1Reviews the tenant-wide Teams external access, guest access and anonymous meeting settings against recommended values.
Get-TeamsMeetingSettingsReport.ps1Reports the security and feature settings of every Teams meeting policy plus the tenant meeting configuration.
Get-TeamsPhoneNumberInventory.ps1Inventories every Teams phone number with its type, assignment, capabilities, location and PSTN partner.
Get-TeamsUserPolicyAssignments.ps1Reports the Teams policies directly assigned to each user, finds who has a given policy and optionally exports group assignments.
Get-TeamsVoiceEnabledUsers.ps1Reports Enterprise Voice enabled Teams users with their phone number, voice policies, licensing and configuration gaps.
Grant-TeamsPolicies.ps1Bulk-assigns Teams policies to users (one by one or as batch operations) or to a group, with validation and a preview mode.
Add-SPOSiteCollectionAdmin.ps1Grants (or with -Remove revokes) site collection administrator rights for an account on selected SharePoint Online sites or OneDrives.
Export-SPOTenantSettings.ps1Exports all SharePoint Online tenant settings to JSON, assesses the key sharing and security settings and diffs against an earlier export.
Get-SPODeletedSitesReport.ps1Reports the SharePoint Online sites in the tenant recycle bin with their remaining retention, and optionally restores or purges them.
Convert-M365DirectLicensesToGroup.ps1Migrates direct license assignments of one SKU to group-based licensing without interrupting the users' service.
Export-M365SkuCatalog.ps1Exports the tenant's SKU catalog (with friendly names and consumption) and the service plans inside every SKU.
Get-M365CopilotLicenseReport.ps1Reports Microsoft 365 Copilot license consumption, every licensed user and, optionally, their Copilot usage per app.
Get-M365GroupBasedLicensingErrors.ps1Lists every group that assigns licenses, its processing state and the members whose group-based assignment failed.
Get-M365LicenseAssignmentPaths.ps1Reports how every licensed user received each SKU (direct, group-based or both) together with assignment errors.
Get-M365LicenseChangesAudit.ps1Reports who added or removed which licenses for which users, from the Microsoft Entra directory audit log.
Get-M365LicenseReport.ps1Reports Microsoft 365 license consumption per SKU and, optionally, licensed users whose licenses could be reclaimed.
Get-M365ServicePlanReport.ps1Reports the service plans inside every subscribed SKU and, per user, which plans are disabled or not provisioned.
Get-M365SubscriptionsReport.ps1Reports every commercial subscription of the tenant with status, trial flag, renewal/expiry date and SKU consumption.
Get-M365UsageLocationReport.ps1Finds member users without a usage location, suggests one from their country attribute and optionally sets it.
Set-M365UserLicenses.ps1Assigns and removes Microsoft 365 licenses for one user or a CSV of users, with pre-flight checks and a results CSV.
Export-M365UsageReportsBundle.ps1Downloads a bundle of Microsoft 365 usage detail reports (users, mailboxes, apps, OneDrive, SharePoint, Teams, groups, Viva Engage, activations) as CSV files.
Get-M365ActivationsReport.ps1Reports Microsoft 365 Apps, Project and Visio activations per user and device platform from the Graph usage reports.
Get-M365ActiveUsersReport.ps1Reports Microsoft 365 user activity per workload from the Graph usage reports and flags inactive licensed users.
Get-M365AppsUsageReport.ps1Reports which Microsoft 365 Apps (Outlook, Word, Excel, PowerPoint, OneNote, Teams) and platforms each user actually uses.
Get-M365EmailActivityReport.ps1Reports Exchange Online email activity per user (sent, received, read, meetings) from the Graph usage reports.
Get-M365GroupsActivityReport.ps1Reports Microsoft 365 group activity, membership, guests, owners and storage from the Graph usage reports.
Get-M365MailboxUsageReport.ps1Reports Exchange Online mailbox sizes, quotas and archive adoption from the Graph usage reports (no Exchange module needed).
Get-M365OneDriveActivityReport.ps1Reports OneDrive for Business user activity, sync adoption and external sharing from the Graph usage reports.
Get-M365VivaEngageActivityReport.ps1Reports Viva Engage (Yammer) user activity, communities and device usage from the Graph usage reports.
Get-M365WorkloadAdoptionSummary.ps1Summarises Microsoft 365 adoption per workload (active vs inactive users and the daily active-user trend) from the Graph usage reports.
Export-M365TenantSettingsSnapshot.ps1Exports a JSON snapshot of tenant-wide Microsoft 365 settings and diffs it against a previous snapshot for change tracking.
Get-M365DomainsReport.ps1Reports every domain in the tenant with verification, authentication type, services and password policy, plus DNS and federation details.
Install-Prerequisites.ps1Installs or updates the PowerShell modules required by the scripts in this repository.
Get-DefenderAlertsReport.ps1Reports alerts from Microsoft Defender XDR (unified alerts API) for the last N days.
Get-DefenderIncidentsReport.ps1Reports Microsoft Defender XDR incidents for triage, including how long each one has been open.
Get-DefenderSecureScore.ps1Shows the current Microsoft Secure Score and the improvement actions with the largest remaining point gap.
The complete, documented list for this folder — with what each script does, the permissions it needs and whether it changes anything — is in the folder README on GitHub.
Get-EXOExternalForwardingReport.ps1Finds mail leaving the tenant through mailbox forwarding or inbox rules, and optionally removes it.
Get-EXOMailboxPermissionsReport.ps1Audits delegated mailbox access: FullAccess, SendAs and SendOnBehalf grants across Exchange Online mailboxes.
Get-EXOMailboxSizeReport.ps1Reports mailbox and archive size, item counts and quota usage for Exchange Online mailboxes.
The complete, documented list for this folder — with what each script does, the permissions it needs and whether it changes anything — is in the folder README on GitHub.
A script only changes something when you pass an explicit switch such as -RetireDevices or -Remediate. Every change supports -WhatIf and -Confirm.
Each script requests only the Graph scopes or admin roles it needs and lists them in its help and in the folder README.
Microsoft Graph PowerShell SDK (v1.0 where possible) and Exchange Online PowerShell V3. No retired AzureAD or MSOnline modules.
No PowerShell 7-only syntax, so the scripts run wherever your admins already work.
Get-Help .\Script.ps1 -Full works everywhere. Reports land in .\Reports\ as timestamped CSV files; add -PassThru to keep working with the objects.
Same parameter names (-OutputPath, -PassThru, -DaysInactive, -InputCsv), same helpers, same summary style — learn one script and you know them all.
Before you run anything: read the script's help (Get-Help .\Script.ps1 -Full), check the permissions it requests, and try it in a test tenant or with -WhatIf first. The scripts are published under the MIT licence — use them, adapt them, and send improvements back through GitHub.
Tell me which report or clean-up task you'd like automated, and it may become the next addition to the repository.