Microsoft Graph PowerShell commands cheat sheet

Install the Microsoft Graph PowerShell SDK (v1.0 cmdlets) for the current user.

Beta cmdlets live in a separate module: Install-Module Microsoft.Graph.Beta. Select-MgProfile no longer exists in v2.

Update the SDK and its sub-modules to the latest release.

Sign in with delegated access and request the permission scopes you need.

Add -UseDeviceAuthentication on a machine without a browser. Run it again with extra scopes to add permissions.

Sign in app-only with an app registration and a certificate, for unattended scripts.

Show the signed-in account, tenant, auth type and granted scopes.

Show the API URI a cmdlet calls and the permissions it can use.

Use -Uri "/users/{id}" to go the other way and find cmdlets for an API path.

Search Graph permission names and descriptions.

Sign out and end the current Graph session.

Get one user by object ID or user principal name.

Scope: User.Read.All (User.ReadBasic.All for basic properties only).

List every user, returning the properties you ask for.

Without -All only the first page is returned. Many properties, such as AccountEnabled, are only filled in when you name them in -Property.

Find users with an OData filter.

Run an advanced query (endsWith, ne, not, counts) that needs the eventual consistency header.

Advanced queries need both -ConsistencyLevel eventual and -CountVariable. The count lands in $userCount.

List users who have no licence assigned.

Use single quotes so PowerShell does not expand $count.

Create a cloud user account.

Scope: User.ReadWrite.All (least privileged: User.Create).

Set the user's usage location, which must be set before a licence can be assigned.

Two-letter ISO 3166 code such as US, GB or IN. Scope: User.ReadWrite.All (least privileged: User.ReadUpdate.All).

Block a user from signing in by disabling the account.

Warning: Warning: the user is blocked from signing in to every app. Least-privileged scopes: User.EnableDisableAccount.All plus User.Read.All; disabling an admin needs a suitably privileged admin role. Use -AccountEnabled to re-enable.

Invalidate a user's refresh tokens and browser session cookies so they must sign in again.

Warning: Warning: signs the user out of every app and device; there can be a delay of a few minutes. Scope: User.RevokeSessions.All.

Delete a user account.

Warning: Warning: the user, mailbox and licence assignments move to deleted items and are permanently deleted after 30 days if not restored. Scope: User.ReadWrite.All.

Restore a recently deleted user, group, application or service principal from deleted items.

Deleted items stay available for up to 30 days, then are deleted permanently.

List the groups and directory roles a user belongs to directly.

Get a user's manager.

List the tenant's licence SKUs with SkuId, SkuPartNumber and consumed units.

Scope: LicenseAssignment.Read.All (Organization.Read.All also works).

Assign a licence to a user.

Both -AddLicenses and -RemoveLicenses are required, even when one is empty. The user needs a UsageLocation first. Scope: LicenseAssignment.ReadWrite.All.

Remove a licence from a user.

Warning: Warning: the user loses the services in that licence, and service data tied to it can be lost. Scope: LicenseAssignment.ReadWrite.All.

Show the licences and service plans assigned to a user.

Scope: LicenseAssignment.Read.All.

Find groups, for example by display name.

Scope: Group.Read.All. Use -All to list every group.

Create a security group.

Scope: Group.ReadWrite.All.

Create a Microsoft 365 group.

Add a user or other directory object to a group.

Scope: GroupMember.ReadWrite.All.

List every member of a group.

Scope: GroupMember.Read.All. Results are directory objects; details such as the UPN are in AdditionalProperties.

Add an owner to a group.

Remove a member from a group.

Warning: Warning: the member loses any access, licences or policies applied through the group. Scope: GroupMember.ReadWrite.All.

List the directory roles that are activated in the tenant.

Scope: RoleManagement.Read.Directory. Only activated roles are returned; Get-MgRoleManagementDirectoryRoleAssignment covers every assignment.

List members of an activated directory role, such as Global Administrator.

Scope: RoleManagement.Read.Directory.

List role assignments through the unified RBAC API, for example all roles held by one user.

Scope: RoleManagement.Read.Directory. principalId and roleDefinitionId support eq and in filters.

List a user's registered authentication methods, such as Authenticator, phone and FIDO2.

Scope for other users: UserAuthenticationMethod.Read.All; the admin also needs a role such as Global Reader or Authentication Administrator.

Read Entra ID sign-in logs.

Scope: AuditLog.Read.All. userPrincipalName supports eq and startsWith; createdDateTime supports eq, le and ge. Only data within the Entra retention period is returned.

Read sign-ins since a given UTC date and time.

Read the Entra ID audit log of directory changes.

Scope: AuditLog.Read.All.

List devices registered or joined to Entra ID.

Scope: Device.Read.All.

List devices registered by a user.

List app registrations, or find one by its application (client) ID.

Scope: Application.Read.All.

List enterprise applications (service principals) in the tenant.

Scope: Application.Read.All.

Call any Microsoft Graph endpoint directly using the current session.

Useful when no cmdlet exists yet. Use single quotes so PowerShell does not expand $top.

Send a write request, such as updating a user property, with a request body.