AI365

Community and open source

I write PowerShell scripts for real Microsoft 365 and Azure admin work, and publish them here so other admins can use them directly. Everything lives on this page, no separate repo to dig through.

Microsoft 365 PowerShell scripts

Scripts I use on real tenants. Copy what you need directly from here. Read them before you run them, and test in a safe tenant first.

Microsoft 365

Get-UnassignedLicenseReport

Reports how many licenses of each SKU are purchased versus assigned, so unused, paid for seats show up as a clear number instead of being buried in the billing portal.

Get-UnassignedLicenseReport.ps1 317
Governance

Get-PowerPlatformDlpPolicyReport

Reports every Power Platform data loss prevention policy and which connectors it classifies as business, non business, or blocked, so DLP coverage can be verified environment by environment.

Get-PowerPlatformDlpPolicyReport.ps1 320
Governance

Get-PowerAutomateFlowOwnerReport

Lists every Power Automate flow across the tenant grouped by owner, flagging flows owned by individual users rather than a shared account, since those break the moment that person leaves.

Get-PowerAutomateFlowOwnerReport.ps1 236
Microsoft 365

Get-PowerAppsInventory

Exports every Power App in the tenant with its owner, environment and last modified date, useful for finding orphaned apps built by someone who has since left.

Get-PowerAppsInventory.ps1 101
Automation

Backup-AzurePolicyDefinitions

Exports every custom Azure Policy definition and initiative in the subscription to JSON, so custom governance work can be version controlled or restored after an accidental change.

Backup-AzurePolicyDefinitions.ps1 190
Governance

Get-AzureTagComplianceReport

Checks every resource group against a required tag list and reports which resource groups are missing which tags, so cost and ownership reporting stays reliable.

Get-AzureTagComplianceReport.ps1 505
Azure AI

Get-AzureManagementGroupInventory

Maps the full management group hierarchy along with subscriptions under each node, so the actual structure can be verified against what governance policy assumes it looks like.

Get-AzureManagementGroupInventory.ps1 925
Azure AI

Get-AzureReservationUtilizationReport

Reports utilization percentage for every reserved instance and savings plan, flagging underused reservations, where you paid upfront for capacity that is not actually being consumed.

Get-AzureReservationUtilizationReport.ps1 217
Azure AI

Get-AzureBudgetAlertStatus

Reports every configured budget in the subscription, its threshold, and current spend against it, so budget alerts can be verified as actually working rather than just assumed configured.

Get-AzureBudgetAlertStatus.ps1 211
Governance

Get-AzureResourceLockReport

Lists every resource lock in the subscription with its scope and lock level, so a forgotten CanNotDelete lock does not cause confusion during a future cleanup or teardown.

Get-AzureResourceLockReport.ps1 615
Governance

Get-AzureRoleAssignmentAuditReport

Exports every role assignment across the subscription with scope, principal and role name, flagging Owner grants at the subscription level, which should be rare.

Get-AzureRoleAssignmentAuditReport.ps1 377
Azure AI

Get-AzureUnusedResourceReport

Finds unattached disks, unused public IPs, and empty resource groups across the subscription in one pass, the classic sources of quiet Azure cost that nobody owns.

Get-AzureUnusedResourceReport.ps1 329
Governance

Get-AzurePolicyComplianceReport

Summarizes Azure Policy compliance state across the subscription by initiative, showing non compliant resource counts so remediation effort can be prioritized by scale.

Get-AzurePolicyComplianceReport.ps1 280
Azure AI

Get-AzureDnsZoneReport

Exports every record set from every Azure DNS zone in the subscription to CSV, giving you an offline reference of the tenant's actual DNS configuration.

Get-AzureDnsZoneReport.ps1 258
Azure AI

Get-AzurePrivateEndpointReport

Lists every private endpoint in the subscription, the resource it connects to, and its connection approval status, useful for confirming private connectivity actually landed where expected.

Get-AzurePrivateEndpointReport.ps1 88
Azure AI

Get-AzureLoadBalancerHealthReport

Reports backend pool health probe status for every Azure Load Balancer, so a backend that has been silently unhealthy does not go unnoticed until users complain.

Get-AzureLoadBalancerHealthReport.ps1 353
Azure AI

Get-AzureVNetPeeringReport

Maps every virtual network peering connection in the subscription and its state, so a broken or misconfigured peering does not go unnoticed until connectivity fails.

Get-AzureVNetPeeringReport.ps1 923
Azure AI

Get-AzurePublicIPInventory

Lists every public IP address in the subscription, what resource it is attached to (or unattached), and its SKU, useful for catching unused public IPs that are still costing money.

Get-AzurePublicIPInventory.ps1 485
Azure AI

Get-AzureFirewallRuleReport

Exports application and network rule collections from Azure Firewall to a readable table, so a firewall policy that has grown over years stays reviewable.

Get-AzureFirewallRuleReport.ps1 722
Governance

Get-AzureNSGRuleAuditReport

Exports every custom inbound rule from every network security group in the subscription to a single CSV, flagging any rule that allows traffic from any source on a sensitive port.

Get-AzureNSGRuleAuditReport.ps1 542
Azure AI

Get-AzureBlobLifecyclePolicyReport

Reports the blob lifecycle management policy configured on every storage account, flagging accounts with no lifecycle rules at all, where old data likely sits at full price forever.

Get-AzureBlobLifecyclePolicyReport.ps1 141
Governance

Get-AzureStorageAccountAccessReport

Reports network access rules, public blob access, and shared key access settings for every storage account, so a permissive default from a quick test does not stay live in production.

Get-AzureStorageAccountAccessReport.ps1 932
Azure AI

Get-AzureAvailabilitySetReport

Lists every availability set with the VMs assigned to it and how many fault and update domains are actually in use, so a set with only one VM (defeating its purpose) gets flagged.

Get-AzureAvailabilitySetReport.ps1 774
Governance

Get-AzureVMDiskEncryptionStatus

Reports disk encryption status for every managed disk attached to every VM, flagging any that are not encrypted, ahead of a compliance audit.

Get-AzureVMDiskEncryptionStatus.ps1 394
Azure AI

Get-AzureVMNetworkInterfaceReport

Reports every VM's network interfaces with private and public IP assignment and the NSG attached, useful for a network inventory without opening each VM's overview page.

Get-AzureVMNetworkInterfaceReport.ps1 269
Azure AI

Get-AzureVMExtensionInventory

Lists every VM extension installed across all VMs in the subscription with its provisioning state, so failed or outdated extensions get caught during a health review.

Get-AzureVMExtensionInventory.ps1 464
Automation

Start-AzureVMScheduledShutdown

Sets or updates the auto shutdown schedule on every VM in a resource group, useful for enforcing a consistent shutdown time across dev and test environments to cut cost.

Start-AzureVMScheduledShutdown.ps1 135
Azure AI

Get-AzureVMBackupStatusReport

Reports whether every Azure VM is actually included in a backup policy, and the result of its most recent backup job, since a VM missing from a policy is easy to overlook until you need it.

Get-AzureVMBackupStatusReport.ps1 333
Azure AI

Get-AzureVMSizeRightsizingReport

Compares average CPU utilization from Azure Monitor against VM size for every VM, flagging consistently underused machines that are likely oversized for their workload.

Get-AzureVMSizeRightsizingReport.ps1 573
Azure AI

Get-AzureVMPatchComplianceReport

Reports patch assessment status for every Azure VM enrolled in Update Management, flagging machines with pending critical or security updates.

Get-AzureVMPatchComplianceReport.ps1 571
Governance

Get-PurviewInsiderRiskAlertReport

Summarizes open insider risk management alerts by risk level and policy, giving a quick read on whether insider risk signals are trending up without opening individual case files.

Get-PurviewInsiderRiskAlertReport.ps1 836
Governance

Get-PurviewEdiscoveryHoldReport

Lists every eDiscovery case and the holds within it, along with the locations each hold covers, so an old hold from a closed case does not keep data locked up indefinitely.

Get-PurviewEdiscoveryHoldReport.ps1 348
Governance

Get-PurviewAuditLogReport

Searches the unified audit log for a specific user or activity type over a date range and exports the results to CSV, faster than repeatedly filtering in the compliance portal.

Get-PurviewAuditLogReport.ps1 355
Governance

Get-PurviewRetentionPolicyReport

Lists every retention policy and label with its scope, retention period and delete action, in one table so retention configuration can be audited without opening the compliance center.

Get-PurviewRetentionPolicyReport.ps1 934
Governance

Get-PurviewDlpIncidentReport

Summarizes DLP policy matches over a given period by policy name and severity, so the effectiveness of each DLP rule can be judged from real incident volume, not a guess.

Get-PurviewDlpIncidentReport.ps1 120
Governance

Get-PurviewSensitivityLabelReport

Reports every sensitivity label with its publish scope and protection settings, so a label that was created but never actually published to any policy gets caught.

Get-PurviewSensitivityLabelReport.ps1 598
Governance

Get-DefenderEndpointOnboardingReport

Cross references Intune managed devices against Defender for Endpoint onboarding status, flagging devices that are managed but not sending security signal.

Get-DefenderEndpointOnboardingReport.ps1 902
Governance

Get-DefenderAntiMalwarePolicyReport

Reports anti-malware policy settings across the tenant, including which file types are blocked and whether zero hour auto purge is enabled, in one comparison table.

Get-DefenderAntiMalwarePolicyReport.ps1 436
Governance

Get-DefenderSubmissionsReport

Lists every email or file submitted to Microsoft for analysis (phishing, malware, spam) along with the verdict returned, so you can confirm follow up actions actually happened.

Get-DefenderSubmissionsReport.ps1 153
Governance

Get-SecurityAlertsSummary

Pulls a single combined summary across Defender alerts, risky sign ins and DLP incidents for a quick daily standup update without checking three separate portals.

Get-SecurityAlertsSummary.ps1 157
Governance

Get-DefenderIncidentReport

Summarizes open Microsoft Defender XDR incidents by severity and assigned owner, so leadership gets a clean weekly snapshot without pulling raw alert data.

Get-DefenderIncidentReport.ps1 442
Governance

Get-DefenderVulnerabilityReport

Lists the highest severity software vulnerabilities currently detected across managed devices, along with the number of exposed devices per vulnerability, to prioritize patching.

Get-DefenderVulnerabilityReport.ps1 208
Governance

Get-DefenderSecureScoreReport

Tracks Microsoft Secure Score over time by pulling the current score plus the top unimplemented recommendations ranked by impact, so security work stays prioritized by what actually moves the number.

Get-DefenderSecureScoreReport.ps1 461
Governance

Get-DefenderAlertReport

Summarizes Microsoft Defender alerts from the last N days by severity and category, so a spike in a particular alert type gets noticed instead of scrolling through the security portal.

Get-DefenderAlertReport.ps1 213
Governance

Get-WindowsUpdateComplianceReport

Summarizes patch compliance across managed Windows devices by comparing installed update levels against the latest available cumulative update, grouped by device model.

Get-WindowsUpdateComplianceReport.ps1 632
Governance

Get-BitLockerRecoveryKeyReport

Reports which managed Windows devices have a BitLocker recovery key escrowed to Entra ID, so you catch machines with encryption enabled but no recoverable key before someone gets locked out.

Get-BitLockerRecoveryKeyReport.ps1 872
Governance

Get-IntuneCertificateExpiryReport

Reports certificates deployed to managed devices via SCEP or PKCS profiles that are approaching expiry, so devices do not silently lose Wi-Fi or VPN access when a cert lapses.

Get-IntuneCertificateExpiryReport.ps1 808
Microsoft 365

Get-IntuneDeviceInventoryReport

Exports a full hardware and enrollment inventory for every managed device (model, serial, OS version, enrollment type, last check in) to a single CSV for asset tracking.

Get-IntuneDeviceInventoryReport.ps1 684
Automation

Backup-IntuneConfigurationProfiles

Exports every device configuration profile in Intune to individual JSON files, giving you a restore point before making bulk configuration changes.

Backup-IntuneConfigurationProfiles.ps1 285
Governance

Get-IntuneAppProtectionPolicyReport

Reports every app protection (MAM) policy and the apps it targets, useful for confirming personal devices without full MDM enrollment still have data protection applied.

Get-IntuneAppProtectionPolicyReport.ps1 692
Microsoft 365

Get-IntuneEnrollmentFailureReport

Summarizes device enrollment failures over a given period, grouped by failure reason, so a recurring enrollment problem gets fixed at the root cause instead of one ticket at a time.

Get-IntuneEnrollmentFailureReport.ps1 562
Governance

Get-IntuneUpdateRingComplianceReport

Reports Windows update ring assignment and current OS build for every managed device, so you can spot devices lagging several builds behind the ring they belong to.

Get-IntuneUpdateRingComplianceReport.ps1 823
Microsoft 365

Get-IntuneAutopilotProfileReport

Reports every Windows Autopilot deployment profile with its settings and how many registered devices are assigned to each one, useful before changing a profile that is already in use.

Get-IntuneAutopilotProfileReport.ps1 448
Governance

Get-IntuneNonCompliantDeviceReport

Lists every device currently marked non compliant along with the specific compliance policy it is failing, since the summary dashboard tells you the count but not the reason.

Get-IntuneNonCompliantDeviceReport.ps1 606
Microsoft 365

Get-IntuneConfigProfileAssignmentReport

Lists every Intune device configuration profile and which groups it is assigned to, so gaps between what you think is deployed and what is actually assigned become visible.

Get-IntuneConfigProfileAssignmentReport.ps1 689
Microsoft 365

Get-IntuneAppDeploymentStatusReport

Reports install status for a given Intune app deployment across all assigned devices, broken down by success, failure and pending, so a bad app push is caught same day.

Get-IntuneAppDeploymentStatusReport.ps1 510
Automation

Backup-EntraNamedLocations

Exports every Conditional Access named location (trusted networks, country lists) to JSON, so location definitions can be restored or diffed after a change.

Backup-EntraNamedLocations.ps1 105
Microsoft 365

Get-EntraDynamicGroupRuleInventory

Exports every dynamic group's membership rule in plain text alongside its member count, so nobody has to decode a rule from memory to understand what a group actually targets.

Get-EntraDynamicGroupRuleInventory.ps1 734
Governance

Get-EntraServicePrincipalCredentialReport

Reports client secrets and certificates configured on service principals across the tenant, along with expiry dates, so an expired credential does not silently break an integration.

Get-EntraServicePrincipalCredentialReport.ps1 787
Microsoft 365

Get-EntraGroupOwnerReport

Lists every Microsoft 365 and security group with its owners, flagging groups that have no owner at all, since ownerless groups cannot be self served and pile up as support tickets.

Get-EntraGroupOwnerReport.ps1 658
Governance

Get-EntraDeviceComplianceGapReport

Cross references Entra ID registered devices against Intune compliance state and flags devices that exist in the directory but show no compliance record at all.

Get-EntraDeviceComplianceGapReport.ps1 369
Governance

Get-EntraRiskyUsersReport

Reports users currently flagged as risky by Entra ID Protection, along with the risk level and last detection, so risky sign ins get triaged the same day they are flagged.

Get-EntraRiskyUsersReport.ps1 308
Governance

Get-EntraMfaRegistrationGapReport

Reports every user who has not registered any multi factor authentication method, so the gap in MFA coverage is a concrete list rather than an assumption.

Get-EntraMfaRegistrationGapReport.ps1 807
Governance

Get-EntraPrivilegedRoleAssignmentReport

Lists every user assigned to a privileged directory role, whether the assignment is permanent or PIM eligible, so standing admin access does not go unreviewed.

Get-EntraPrivilegedRoleAssignmentReport.ps1 564
Governance

Get-EntraAppConsentReport

Lists every enterprise application with delegated or application permissions consented by users or admins, sorted by permission risk, to catch overprivileged third party app grants.

Get-EntraAppConsentReport.ps1 826
Governance

Get-EntraConditionalAccessGapReport

Compares configured Conditional Access policies against a baseline list of expected controls (MFA, legacy auth block, compliant device) and reports which baseline items have no matching policy.

Get-EntraConditionalAccessGapReport.ps1 558
Governance

Get-EntraStaleGuestAccounts

Finds guest accounts that have never signed in, or not signed in for a long time, so they can be reviewed and removed instead of accumulating indefinitely.

Get-EntraStaleGuestAccounts.ps1 214
Governance

Get-EntraGuestUserReport

Lists every guest account in Entra ID with when it was created, its status, and which groups it belongs to, so guest sprawl is visible in one report instead of scattered across group memberships.

Get-EntraGuestUserReport.ps1 548
Microsoft 365

Get-SharePointHubSiteInventory

Lists every hub site in the tenant and the sites associated with each one, useful for confirming the intranet's hub and spoke structure matches what was actually planned.

Get-SharePointHubSiteInventory.ps1 137
Governance

Get-SharePointRetentionLabelReport

Reports which retention labels are published to which SharePoint sites, so you can confirm compliance labels reached the sites they were meant to before relying on them.

Get-SharePointRetentionLabelReport.ps1 418
Governance

Get-SharePointSiteCollectionAdminReport

Lists every user who is a site collection administrator on any site in the tenant, and how many sites they have that role on, to catch overly broad admin assignments.

Get-SharePointSiteCollectionAdminReport.ps1 290
Governance

Get-OneDriveSharingLinksReport

Reports anonymous and external sharing links currently active on a user's OneDrive, useful for reviewing exposure before that user leaves the company.

Get-OneDriveSharingLinksReport.ps1 937
Automation

Backup-SharePointSitePermissions

Exports the full permission structure of a SharePoint site, groups and their members, to a JSON file before you make a bulk permissions change you might need to reverse.

Backup-SharePointSitePermissions.ps1 953
Microsoft 365

Get-SharePointVersionHistorySize

Estimates how much storage is consumed by version history across document libraries, so you know whether trimming version limits is actually worth doing before you change the setting.

Get-SharePointVersionHistorySize.ps1 806
Microsoft 365

Get-SharePointOrphanedSitesReport

Finds SharePoint sites with no recent activity, useful for identifying sites created for a project that ended without anyone decommissioning the site afterward.

Get-SharePointOrphanedSitesReport.ps1 979
Microsoft 365

Get-OneDriveStorageReport

Reports OneDrive storage used and quota for every user, sorted largest first, to catch accounts approaching their limit before sync starts failing.

Get-OneDriveStorageReport.ps1 848
Microsoft 365

Get-SharePointSiteOwnerReport

Lists every SharePoint site collection with its primary and secondary owners, so a site with a single owner who has since left the company gets caught before it becomes an access problem.

Get-SharePointSiteOwnerReport.ps1 176
Governance

Get-SharePointExternalSharingReport

Reports every SharePoint site's external sharing setting alongside the tenant default, so sites that are more permissive than intended stand out immediately.

Get-SharePointExternalSharingReport.ps1 326
Microsoft 365

Get-TeamsAppUsageReport

Summarizes which third party and custom Teams apps are actually installed across teams, so licensing and security reviews are based on real usage rather than a guess.

Get-TeamsAppUsageReport.ps1 322
Microsoft 365

Get-TeamsLiveEventReport

Lists every Teams live event scheduled or held in the tenant along with organizer, attendee limit and recording status, since live events do not show up in the normal meetings view.

Get-TeamsLiveEventReport.ps1 431
Automation

Backup-TeamsMeetingPolicies

Exports every Teams meeting policy configuration to timestamped JSON files, giving you a restore point before making tenant wide meeting policy changes.

Backup-TeamsMeetingPolicies.ps1 455
Governance

Get-TeamsOwnerlessTeamsReport

Finds every team that has zero active owners, which happens more often than expected once the original creator leaves the company, leaving nobody able to manage settings or membership.

Get-TeamsOwnerlessTeamsReport.ps1 154
Microsoft 365

Get-TeamsArchivedTeamsReport

Lists every archived team along with when it was created and its owners, useful for deciding which archived teams are safe to delete outright versus keep for reference.

Get-TeamsArchivedTeamsReport.ps1 655
Microsoft 365

Get-TeamsPhoneNumberInventory

Exports every phone number assigned in Teams Phone, who it is assigned to, and its usage type, so unused or misassigned numbers are easy to catch during a licensing review.

Get-TeamsPhoneNumberInventory.ps1 293
Governance

Get-TeamsExternalAccessReport

Reports tenant level external access and guest access settings for Teams, plus any domain specific allow or block entries, to confirm federation is actually configured the way you think it is.

Get-TeamsExternalAccessReport.ps1 301
Microsoft 365

Get-TeamsMeetingPolicyReport

Exports every Teams meeting policy and its key settings (recording, transcription, external participants, lobby behavior) in one table for a quick tenant wide comparison.

Get-TeamsMeetingPolicyReport.ps1 670
Microsoft 365

Get-TeamsAppPermissionPolicyReport

Reports every Teams app permission policy and which apps are blocked or allowed, so it is clear at a glance what third party apps users can actually install.

Get-TeamsAppPermissionPolicyReport.ps1 984
Microsoft 365

Get-TeamsChannelInventory

Exports every team and its channels, including private and shared channels, to a single CSV so you can see the real channel sprawl across the tenant in one place.

Get-TeamsChannelInventory.ps1 215
Microsoft 365

Get-MailFlowConnectorReport

Lists every inbound and outbound mail flow connector with its configuration, so a legacy connector from an old migration or a third party mail gateway does not go unnoticed.

Get-MailFlowConnectorReport.ps1 134
Governance

Get-QuarantineMessageReport

Summarizes quarantined messages from the last 7 days by reason and recipient, so a spike in phishing or spam quarantine gets noticed the same day instead of during a monthly review.

Get-QuarantineMessageReport.ps1 556
Governance

Get-AntiPhishPolicyReport

Reports every anti-phishing policy's impersonation protection settings and which users or domains are protected, useful when confirming executive accounts are actually covered.

Get-AntiPhishPolicyReport.ps1 371
Governance

Get-SafeLinksPolicyReport

Reports every Safe Links policy and which users or groups it applies to, so you can confirm coverage without opening each policy individually in the Defender portal.

Get-SafeLinksPolicyReport.ps1 457
Microsoft 365

Get-TransportRuleReport

Exports every mail flow rule in the tenant with its conditions, actions and enabled state to a single readable table, so a growing pile of transport rules stays auditable.

Get-TransportRuleReport.ps1 476
Governance

Get-MailboxLitigationHoldStatus

Reports which mailboxes currently have litigation hold enabled and for how long, so holds that were meant to be temporary do not sit forgotten and keep consuming storage.

Get-MailboxLitigationHoldStatus.ps1 970
Microsoft 365

Get-EmailAliasInventory

Exports every SMTP alias for every mailbox in the tenant, flagging any mailbox with an unusually high alias count, which is often a sign of leftover aliases from old naming conventions.

Get-EmailAliasInventory.ps1 309
Microsoft 365

Get-SharedMailboxAutoMappingReport

Lists shared mailboxes and whether automapping is enabled for their delegates, useful for tracking down why a shared mailbox is or is not showing up automatically in someone's Outlook.

Get-SharedMailboxAutoMappingReport.ps1 775
Governance

Get-MailboxDelegateAccessReport

Reports every mailbox that has Full Access or Send As delegates assigned, and to whom, so delegate access does not quietly accumulate without anyone reviewing it.

Get-MailboxDelegateAccessReport.ps1 363
Microsoft 365

Export-DistributionGroupMembership

Exports every distribution group in the tenant along with its full member list to a single CSV, useful for an access review without clicking through each group in the admin center.

Export-DistributionGroupMembership.ps1 318
Microsoft 365

Get-MailboxAutoReplyStatus

Lists every mailbox currently running an automatic reply, with the configured message and end date if one is set. Useful for spotting stale out-of-office replies nobody turned off.

Get-MailboxAutoReplyStatus.ps1 484
Microsoft 365

Get-MailboxSizeReport

Reports mailbox size, item count and quota usage for every mailbox in the tenant, sorted largest first, so you can spot who is close to their limit before it becomes a support ticket.

Get-MailboxSizeReport.ps1 216
Automation

Start-M365UserOffboarding

Full Microsoft 365 offboarding pass for one user or a CSV batch: disables sign in, revokes sessions, clears group/role/app assignments, cleans up the mailbox (hide from GAL, remove aliases, delete inbox rules, wipe mobile device, convert to shared, optional delegate access), removes licenses, and writes a CSV report. Supports -WhatIf.

Start-M365UserOffboarding.ps1 471
Governance

Get-EntraAppSecretExpiryReport

Scans every Entra ID app registration and flags client secrets and certificates that are expired or expiring soon, so you catch broken automation before it breaks.

Get-EntraAppSecretExpiryReport.ps1 543
Governance

Get-MailboxForwardingRules

Scans every mailbox in the tenant for external forwarding, both the ForwardingSmtpAddress set on the mailbox itself and inbox rules that forward or redirect to an outside address. Useful for catching a compromised account or an old forwarding rule someone set up and forgot about.

Get-MailboxForwardingRules.ps1 452
Governance

Export-SharedMailboxPermissionsReport

A PowerShell script that reports on shared mailbox sizes and permissions in Exchange Online, so you can spot large mailboxes or unexpected access before they cause problems.

Export-SharedMailboxPermissionsReport.ps1 576
Governance

Get-DefenderDeviceRiskReport

Pulls every device's risk score from Microsoft Defender for Endpoint via Graph Security API and flags anything above Medium, a fast weekly triage list before you open the full portal.

Get-DefenderDeviceRiskReport.ps1 616
Governance

Backup-ConditionalAccessPolicies

Exports every Conditional Access policy in the tenant to timestamped JSON, conditions, grant controls, and all. Run it before touching CA policies so you always have a rollback point.

Backup-ConditionalAccessPolicies.ps1 264
Automation

Clear-DnsCache (Proactive Remediation)

An Intune Proactive Remediation pair that detects a bloated or stale DNS resolver cache and clears it, a common cause of intermittent name resolution complaints that a simple restart usually fixes anyway.

Clear-DnsCache.ps1 332
Microsoft 365

Export-DeviceCompliance

Exports the compliance policy state for every managed device, including which specific settings each device is passing or failing, to a single CSV for a full fleet compliance review.

Export-DeviceCompliance.ps1 512
Automation

Get-InstalledAntivirus

Reports the registered antivirus product and its real time protection and up to date status on every managed Windows device, using the same Windows Security Center data Defender itself reads from.

Get-InstalledAntivirus.ps1 359
Automation

Get-MicrosoftGraphPermissions

Looks up the delegated and application permission scopes required for a given Microsoft Graph cmdlet or HTTP route, so you know exactly what to request during app registration instead of guessing and over-scoping.

Get-MicrosoftGraphPermissions.ps1 445
Microsoft 365

Get-M365ServiceHealth

Reports current Microsoft 365 service health issues and advisories across every workload, with severity and impacted services, so incidents get noticed before the help desk starts filling up.

365healthstatus.ps1 833
Azure AI

Backup-AzureResourceGroupInventory

Snapshots every resource in a resource group (name, type, location, tags) to timestamped JSON. Not a full backup, a fast before-and-after diff before you touch anything.

Backup-AzureResourceGroupInventory.ps1 613
Governance

Get-TeamsGuestAccessReport

Audits every guest account in the tenant, which Teams they can reach, and how long ago they last signed in. Built for the periodic external-access review.

Get-TeamsGuestAccessReport.ps1 795
Microsoft 365

Get-SharePointSiteStorageReport

Lists every SharePoint site collection with its storage usage and quota, sorted by percent full, so you know which sites are actually driving the bill.

Get-SharePointSiteStorageReport.ps1 361
Microsoft 365

Get-M365LicenseUsageReport

Pulls every license SKU in the tenant and shows assigned versus available seats, so you can spot licenses worth reclaiming before the next renewal.

Get-M365LicenseUsageReport.ps1 168
Automation

Get-InactiveEntraDevices

Finds Entra ID devices with no sign-in activity in a given window, so you can clean up stale device records before an audit instead of during one.

Get-InactiveEntraDevices.ps1 930
Automation

Get-EndpointHealthStatus

Runs a quick local health check on a Windows endpoint: disk space, Defender status, last update, uptime, and DNS resolution, with pass/warning/critical flags.

Get-EndpointHealthStatus.ps1 389
Microsoft 365

Get-IntuneDeviceCompliance

Queries Microsoft Graph for every Intune-managed device and builds a compliance summary report (state, OS, last sync, encryption) as CSV.

Get-IntuneDeviceCompliance.ps1 697
Microsoft 365

Get-AutopilotHardwareHash

Collects a device's Windows Autopilot hardware hash and serial number, and exports it as a CSV ready to import into the Intune Autopilot portal.

Get-AutopilotHardwareHash.ps1 282