5 PowerShell Snippets for Everyday Microsoft 365 Admin Work

In this post I share five PowerShell snippets I use regularly in day-to-day Microsoft 365 administration — from inactive users to MFA status. All examples are based on the Microsoft Graph PowerShell SDK.

Prerequisite: Microsoft Graph PowerShell SDK

If you haven’t installed it yet:

Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "User.Read.All","AuditLog.Read.All","Reports.Read.All"

1. Find users inactive for the last 90 days

$cutoff = (Get-Date).AddDays(-90)
Get-MgUser -All -Property DisplayName,UserPrincipalName,SignInActivity |
  Where-Object { $_.SignInActivity.LastSignInDateTime -lt $cutoff } |
  Select-Object DisplayName, UserPrincipalName, @{N='LastSignIn';E={$_.SignInActivity.LastSignInDateTime}}

Handy for regular license and orphaned-account clean-up.

2. Overview of license assignments

Get-MgUser -All -Property DisplayName,UserPrincipalName,AssignedLicenses |
  Where-Object { $_.AssignedLicenses.Count -eq 0 } |
  Select-Object DisplayName, UserPrincipalName

Lists all users with no assigned license — useful for spotting orphaned or misconfigured accounts.

3. Audit guest users

Get-MgUser -All -Filter "userType eq 'Guest'" -Property DisplayName,Mail,CreatedDateTime |
  Select-Object DisplayName, Mail, CreatedDateTime |
  Sort-Object CreatedDateTime -Descending

Shows all external guest accounts sorted by creation date — well suited for periodic access reviews.

4. Export mailbox sizes

Connect-ExchangeOnline
Get-Mailbox -ResultSize Unlimited |
  Get-MailboxStatistics |
  Select-Object DisplayName, TotalItemSize, ItemCount |
  Export-Csv -Path "mailbox-sizes.csv" -NoTypeInformation

Requires the Exchange Online PowerShell module. Handy before migrations or for capacity planning.

5. Check MFA status for all users

Get-MgUser -All -Property DisplayName,UserPrincipalName |
  ForEach-Object {
    $methods = Get-MgUserAuthenticationMethod -UserId $_.Id
    [PSCustomObject]@{
      User = $_.UserPrincipalName
      MFA  = ($methods.Count -gt 1)
    }
  } | Where-Object { -not $_.MFA }

Lists users without a registered MFA method — a good starting point before enforcing a Conditional Access MFA policy.

Conclusion

The Microsoft Graph PowerShell SDK now covers almost every admin task that used to require several separate, sometimes deprecated modules. If you regularly need reports or audits, a handful of saved snippets saves a lot of clicking around in the portal.

Post Views: 5