Skip to main content

Microsoft 365 — Overview & Connection

Scripts in this section administer the major Microsoft 365 workloads — Entra ID, Exchange Online, SharePoint, OneDrive, Teams, Intune, Purview, and Defender. Before the per-workload scripts, this page covers how to connect cleanly and securely.

Modules per workload

Microsoft 365 has no single PowerShell module; each workload has its own. Install only what you need:

WorkloadModuleInstall
Entra ID, Intune, Defender, reportsMicrosoft.GraphInstall-Module Microsoft.Graph
Exchange Online, Purview (audit/DLP)ExchangeOnlineManagementInstall-Module ExchangeOnlineManagement
SharePoint / OneDrive (PnP)PnP.PowerShellInstall-Module PnP.PowerShell
SharePoint admin (classic)Microsoft.Online.SharePoint.PowerShellInstall-Module Microsoft.Online.SharePoint.PowerShell
TeamsMicrosoftTeamsInstall-Module MicrosoftTeams

Tip — Install scope

Install for the current user to avoid needing admin rights on shared hosts: Install-Module <name> -Scope CurrentUser. Keep modules updated — the Graph SDK in particular changes quickly.

Interactive vs app-only authentication

  • Interactive (Connect-MgGraph -Scopes ..., Connect-ExchangeOnline -UserPrincipalName ...) is fine for ad-hoc, attended work. It runs as you, with your roles, and prompts for MFA.
  • App-only / certificate-based is the right choice for unattended automation (scheduled tasks, runbooks). Register an Entra app, grant it the minimum application permissions, and authenticate with a certificate — never a client secret in a script. This avoids storing credentials and keeps automation auditable.

Least privilege

Request only the scopes/permissions a script needs, and prefer read-only scopes for reporting. For example, a script that only reports on users needs User.Read.All, not User.ReadWrite.All. Over-scoped automation is a standing risk — exactly the kind of thing the MFA & Entra ID Hardening baseline exists to contain.

Workloads

  • Entra ID — identity, applications, and access.
  • Exchange Online, SharePoint Online, OneDrive, Teams, Intune, Purview, and Defender — see the sidebar.