Admin cheat sheet

Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "User.Read.All","Group.Read.All"
Get-MgUser -Top 10
Get-MgGroup -Filter "displayName eq 'Marketing'"
Disconnect-MgGraph

Connect-ExchangeOnline
Get-MailboxStatistics leaver@contoso.com | Select-Object TotalItemSize
Get-Mailbox leaver@contoso.com | Format-List LitigationHoldEnabled,InPlaceHolds,ArchiveStatus,RecipientTypeDetails

Set-Mailbox leaver@contoso.com -Type Shared

Add-MailboxPermission leaver@contoso.com -User successor@contoso.com -AccessRights FullAccess -AutoMapping $true
Add-RecipientPermission leaver@contoso.com -Trustee successor@contoso.com -AccessRights SendAs -Confirm:$false

Connect-ExchangeOnline
Get-Mailbox user@contoso.com | Format-List RecipientTypeDetails,PersistedCapabilities,LitigationHoldEnabled

Set-Mailbox user@contoso.com -LitigationHoldEnabled $true -LitigationHoldDuration 2555 `
  -LitigationHoldOwner legal@contoso.com -Comment "Matter 2026-014, per Legal 2026-09-03"

Import-Csv .\custodians.csv | ForEach-Object {
  Set-Mailbox $_.UPN -LitigationHoldEnabled $true -Comment "Matter 2026-014"
}

Connect-ExchangeOnline
New-DkimSigningConfig -DomainName contoso.com -Enabled $false   # creates keys if missing
Get-DkimSigningConfig -Identity contoso.com | Format-List Selector1CNAME,Selector2CNAME

Set-DkimSigningConfig -Identity contoso.com -Enabled $true

Set-OMEConfiguration -Identity "OME Configuration" `
    -EmailText "Encrypted message from Contoso" `
    -PortalText "Contoso secure messages" `
    -DisclaimerText "This message is confidential..." `
    -OTPEnabled $true `
    -SocialIdSignIn $true `
    -BackgroundColor "#003366"

New-RMSTemplate -Name "Legal Privilege" `
    -DepartmentName "Legal" `
    -RightsDefinitions @(
        New-Object Microsoft.Online.Administration.RightsDefinition `
            -Property @{
                EmailAddress = "everyone@contoso.com"
                Rights = "VIEW","REPLY","REPLYALL","EDIT","EXPORT","EXTRACT","FORWARD"
            }
    )

Set-Mailbox anna.svensson -EmailAddresses @{add="anna@contoso.com"}

Get-MgSubscribedSku | Select-Object SkuPartNumber, @{n="Enabled";e={$_.PrepaidUnits.Enabled}}, ConsumedUnits

Get-MgUser -All -Filter "assignedLicenses/any(x:x/skuId eq 'sku-guid')" -ConsistencyLevel eventual -CountVariable c -Property DisplayName,UserPrincipalName,AccountEnabled,SignInActivity

Connect-MgGraph -Scopes "User.ReadWrite.All","Directory.AccessAsUser.All"
Update-MgUser -UserId leaver@contoso.com -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId leaver@contoso.com

Connect-ExchangeOnline
Set-MailboxAutoReplyConfiguration leaver@contoso.com -AutoReplyState Enabled -ExternalAudience All `
  -InternalMessage "This person has left. Contact successor@contoso.com." -ExternalMessage "This person has left. Contact successor@contoso.com."
Set-Mailbox leaver@contoso.com -ForwardingAddress successor@contoso.com -DeliverToMailboxAndForward $true

Connect-MgGraph -Scopes "User.ReadWrite.All"
Get-MgDirectoryDeletedItemAsUser -All | Where-Object UserPrincipalName -like "j.smith*" | Select-Object Id,UserPrincipalName,DeletedDateTime

Restore-MgDirectoryDeletedItem -DirectoryObjectId <object id>

$cutoff = (Get-Date).AddDays(-90).ToString("o")
Get-MgUser -All -Property UserPrincipalName,SignInActivity,AccountEnabled |
  Where-Object { 
    $_.AccountEnabled -and 
    $_.SignInActivity.LastSignInDateTime -lt $cutoff 
  } |
  Select-Object UserPrincipalName, @{N="LastSignIn";E={$_.SignInActivity.LastSignInDateTime}}

Get-MgUser -All -Property AssignedLicenses |
  Where-Object { $_.AssignedLicenses.Count -gt 1 } |
  # Detailed analysis of which SKUs overlap

Connect-MgGraph -Scopes "User.Read.All,Organization.Read.All"

# Active licences in the tenant
Get-MgSubscribedSku | 
  Select-Object SkuPartNumber, PrepaidUnits, ConsumedUnits

# Users with a specific licence
$skuId = (Get-MgSubscribedSku -Filter "SkuPartNumber eq 'SPE_E5'").SkuId
Get-MgUser -All -Filter "assignedLicenses/any(x:x/skuId eq $skuId)" |
  Select-Object DisplayName, UserPrincipalName

$cutoff = (Get-Date).AddDays(-90).ToString("o")
Get-MgUser -All -Property UserPrincipalName,SignInActivity |
  Where-Object { $_.SignInActivity.LastSignInDateTime -lt $cutoff } |
  Select-Object UserPrincipalName, @{N="LastSignIn";E={$_.SignInActivity.LastSignInDateTime}}

Connect-ExchangeOnline
Get-EXOMailbox -ResultSize Unlimited |
  Get-EXOMailboxStatistics |
  Where-Object { $_.TotalItemSize -gt 49GB } |
  Select-Object DisplayName, TotalItemSize

# Channel meeting recordings - in the team's SharePoint site
# Non-channel meeting recordings - in the organiser's OneDrive
# Query via Graph for files matching meeting-recording pattern

Connect-SPOService -Url https://yourtenant-admin.sharepoint.com
Get-SPOSite -Limit All |
  Sort-Object StorageUsageCurrent -Descending |
  Select-Object Url, @{N="StorageMB";E={$_.StorageUsageCurrent}}, Owner |
  Export-Csv site-storage.csv -NoTypeInformation

Connect-MgGraph -Scopes "Policy.Read.All"
Get-MgIdentityConditionalAccessPolicy |
  Select-Object DisplayName, State, 
    @{N="UsersIncluded";E={($_.Conditions.Users.IncludeUsers + $_.Conditions.Users.IncludeGroups) -join ","}},
    @{N="UsersExcluded";E={($_.Conditions.Users.ExcludeUsers + $_.Conditions.Users.ExcludeGroups) -join ","}},
    @{N="Apps";E={$_.Conditions.Applications.IncludeApplications -join ","}}

Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"
Get-MgDeviceManagementManagedDevice -All |
  Select-Object DeviceName, OperatingSystem, ComplianceState, LastSyncDateTime

Connect-MgGraph -Scopes "User.Read.All"

Connect-MgGraph -ClientId "app-id" -TenantId "tenant-id" -CertificateThumbprint "thumbprint"

Get-MgDirectoryDeletedItemAsGroup -All | Select-Object DisplayName, Mail, DeletedDateTime, Id

Restore-MgDirectoryDeletedItem -DirectoryObjectId "group-object-id"

// Hunt for connections to known C2 IPs from a TI feed
let MaliciousIPs = ThreatIntelligenceIndicator
    | where Action == "block"
    | where IsActive == true
    | project NetworkIP;
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP in (MaliciousIPs)

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe")
| where FileName in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine

DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName == "powershell.exe"
| where ProcessCommandLine has_any ("DownloadString", "FromBase64", "IEX", "Invoke-Expression")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine

IdentityLogonEvents
| where Timestamp > ago(7d)
| where ActionType == "LogonSuccess"
| summarize Sources = make_set(IPAddress), LogonCount = count() by AccountName, bin(Timestamp, 1d)
| where array_length(Sources) > 5  // 5+ distinct IPs in a day
| order by LogonCount desc

EmailEvents
| where Timestamp > ago(7d)
| where ThreatTypes has "phish"
| join kind=inner (EmailUrlInfo) on NetworkMessageId
| join kind=inner (EmailPostDeliveryEvents | where Action == "Click") on NetworkMessageId
| project Timestamp, Recipient, Subject, Url, ClickedUrl = Url

DeviceProcessEvents
| where Timestamp > ago(1d)
| join kind=leftanti (
    DeviceProcessEvents
    | where Timestamp between (ago(30d) .. ago(1d))
    | distinct FileName, SHA256
) on FileName, SHA256
| where FileName endswith ".exe"
| project Timestamp, DeviceName, FileName, SHA256, FolderPath

Connect-MgGraph -Scopes "User.ReadWrite.All","Directory.AccessAsUser.All"
Update-MgUser -UserId user@contoso.com -AccountEnabled:$false

Revoke-MgUserSignInSession -UserId user@contoso.com

Connect-ExchangeOnline
# Inbox rules — look for delete/move/forward rules with innocuous names like "."
Get-InboxRule -Mailbox user@contoso.com | Format-List Name,Description,Enabled
# Forwarding
Get-Mailbox user@contoso.com | Format-List ForwardingAddress,ForwardingSmtpAddress,DeliverToMailboxAndForward
Set-Mailbox user@contoso.com -ForwardingAddress $null -ForwardingSmtpAddress $null
# Delegates and Send As granted during the compromise window
Get-MailboxPermission user@contoso.com | Where-Object {$_.User -notlike "NT AUTHORITY*"}
Get-RecipientPermission user@contoso.com

DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName == "powershell.exe"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| order by Timestamp desc
| take 100

| where Timestamp > ago(1h)        // last hour
| where Timestamp > ago(7d)        // last 7 days
| where Timestamp between (datetime(2026-05-01) .. datetime(2026-05-05))

DeviceLogonEvents
| where ActionType == "LogonFailed"
| where Timestamp > ago(1d)
| summarize count() by AccountName
| order by count_ desc

| where ProcessCommandLine has "Invoke-Expression"   // case-insensitive contains
| where ProcessCommandLine contains "iex"            // also contains
| where ProcessCommandLine matches regex @"\bIEX\b"  // regex
| where FileName startswith "powershell"

DeviceProcessEvents
| where FileName == "rundll32.exe"
| where Timestamp > ago(1d)
| join DeviceNetworkEvents on DeviceId, Timestamp

// Detect unusual data export by departing employees
let HRData = externaldata(UserPrincipalName:string, DepartureDate:datetime)
    [@"https://your-data-source/hr.csv"] with(format="csv");
let DepartingUsers = 
    HRData
    | where DepartureDate between (now() .. now()+30d);
SignInLogs
| where TimeGenerated > ago(7d)
| where UserPrincipalName in (DepartingUsers | project UserPrincipalName)
| join kind=inner OfficeActivity on $left.UserPrincipalName == $right.UserId
| where Operation in ("FileDownloaded", "SyncDownloadedFiles")
| summarize TotalDownloads = count() by UserPrincipalName, bin(TimeGenerated, 1h)
| where TotalDownloads > 100

Connect-MgGraph -Scopes "Application.Read.All","DelegatedPermissionGrant.Read.All","Directory.Read.All"
# Delegated grants
Get-MgOauth2PermissionGrant -All | Select-Object ClientId, ConsentType, PrincipalId, ResourceId, Scope | Export-Csv .\delegated.csv -NoTypeInformation
# Application permissions on Microsoft Graph
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $graph.Id -All | Select-Object PrincipalDisplayName, PrincipalId, AppRoleId | Export-Csv .\application.csv -NoTypeInformation

Connect-MgGraph -Scopes "Application.Read.All","AuditLog.Read.All","Directory.Read.All"
Get-MgServicePrincipal -All -Property Id,DisplayName,AppId,ServicePrincipalType,AccountEnabled,CreatedDateTime,AppOwnerOrganizationId,Tags,PasswordCredentials,KeyCredentials |
  Select-Object DisplayName, AppId, ServicePrincipalType, AccountEnabled, CreatedDateTime, AppOwnerOrganizationId,
    @{n="Creds";e={$_.PasswordCredentials.Count + $_.KeyCredentials.Count}} |
  Export-Csv .\sps.csv -NoTypeInformation

# On Tenant A
New-OrganizationRelationship -Name "TenantB" `
    -DomainNames "tenantb.com" `
    -FreeBusyAccessEnabled $true `
    -FreeBusyAccessLevel AvailabilityOnly

Connect-MgGraph -Scopes "Group.ReadWrite.All","Organization.Read.All"
$sku = Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "SPE_E3"
Set-MgGroupLicense -GroupId <groupId> -AddLicenses @{SkuId = $sku.SkuId; DisabledPlans = @()} -RemoveLicenses @()

Connect-MgGraph -Scopes "DeviceManagementConfiguration.ReadWrite.All"
$policyId  = "<configurationPolicy id>"
$filterId  = "<filter id>"
$excludeId = "<exclusion group id>"
$body = @{
  assignments = @(
    @{ target = @{
        "@odata.type" = "#microsoft.graph.allDevicesAssignmentTarget"
        deviceAndAppManagementAssignmentFilterId   = $filterId
        deviceAndAppManagementAssignmentFilterType = "include" } },
    @{ target = @{
        "@odata.type" = "#microsoft.graph.exclusionGroupAssignmentTarget"
        groupId = $excludeId } }
  )
} | ConvertTo-Json -Depth 6
Invoke-MgGraphRequest -Method POST -Body $body -ContentType "application/json" `
  -Uri "https://graph.microsoft.com/beta/deviceManagement/configurationPolicies/$policyId/assign"

SigninLogs
| where UserPrincipalName in~ ("svc-recovery-01@contoso.onmicrosoft.com","svc-recovery-02@contoso.onmicrosoft.com")
| project TimeGenerated, UserPrincipalName, IPAddress, ResultType, AppDisplayName

Connect-MgGraph -Scopes "UserAuthenticationMethod.ReadWrite.All"
Get-MgUserAuthenticationMethod -UserId user@contoso.com
# then, for the Authenticator entry you want gone:
Remove-MgUserAuthenticationMicrosoftAuthenticatorMethod -UserId user@contoso.com -MicrosoftAuthenticatorAuthenticationMethodId <id>

$cred = Add-MgApplicationPassword -ApplicationId "app-object-id" -PasswordCredential @{ displayName = "rotation 2026-09"; endDateTime = (Get-Date).AddMonths(12) }
$cred.SecretText

Get-MgApplication -All -Property DisplayName,PasswordCredentials,KeyCredentials |
  ForEach-Object { $app = $_; $app.PasswordCredentials + $app.KeyCredentials |
    Where-Object EndDateTime -lt (Get-Date).AddDays(60) |
    Select-Object @{n="App";e={$app.DisplayName}}, DisplayName, EndDateTime, KeyId }

Install-Script -Name Get-WindowsAutopilotInfo -Force
Get-WindowsAutopilotInfo -OutputFile C:\hash.csv -GroupTag "KW-EU"

# Detection
$svc = Get-Service -Name w32time -ErrorAction Stop
if ($svc.Status -eq 'Running') { exit 0 } else { exit 1 }

# Remediation
Start-Service -Name w32time
Set-Service -Name w32time -StartupType Automatic

:: Download the installation files
setup.exe /download configuration.xml

:: Install Office using the downloaded files
setup.exe /configure configuration.xml

:: Uninstall existing Office
setup.exe /configure uninstall.xml

# Windows
cd "C:\Program Files\Microsoft Office\root\Licensing16"
.\ospp.vbs /dstatus  # diagnose
.\ospp.vbs /unpkeyremove:LASTFIVE  # remove problematic keys
# Then sign back in

Connect-ExchangeOnline
$start = (Get-Date).AddDays(-7); $end = Get-Date
$sessionId = "inv-2026-014"
$all = @()
do {
  $batch = Search-UnifiedAuditLog -StartDate $start -EndDate $end -Operations FileDeleted,FileDeletedFirstStageRecycleBin `
            -UserIds user@contoso.com -SessionId $sessionId -SessionCommand ReturnLargeSet -ResultSize 5000
  $all += $batch
} while ($batch.Count -eq 5000)
$all | Select-Object CreationDate,UserIds,Operations,@{n="Object";e={($_.AuditData|ConvertFrom-Json).ObjectId}} |
  Export-Csv .\deleted-files.csv -NoTypeInformation

Search-UnifiedAuditLog `
    -StartDate (Get-Date).AddDays(-7) `
    -EndDate (Get-Date) `
    -UserIds compromised.user@yourcompany.com `
    -RecordType ExchangeItem,ExchangeAdmin

Search-UnifiedAuditLog `
    -StartDate (Get-Date).AddDays(-1) `
    -EndDate (Get-Date) `
    -UserIds suspect.user@yourcompany.com `
    -Operations FileDownloaded,FileSyncDownloadedFull,SharingSet

Search-UnifiedAuditLog `
    -StartDate (Get-Date).AddDays(-30) `
    -EndDate (Get-Date) `
    -RecordType AzureActiveDirectoryAccountLogon,AzureActiveDirectory `
    -Operations "Add member to role.","Remove member from role."

Search-UnifiedAuditLog `
    -StartDate (Get-Date).AddDays(-7) `
    -EndDate (Get-Date) `
    -RecordType AzureActiveDirectory `
    -Operations "Add OAuth2PermissionGrant.","Consent to application."

Search-UnifiedAuditLog `
    -StartDate (Get-Date).AddDays(-7) `
    -EndDate (Get-Date) `
    -Operations "SensitivityLabelApplied","SensitivityLabelChanged","SensitivityLabelRemoved"

Search-UnifiedAuditLog `
    -StartDate (Get-Date).AddDays(-30) `
    -EndDate (Get-Date) `
    -Operations SharingInvitationCreated,AnonymousLinkCreated,SecureLinkCreated

Get-MgDirectoryDeletedItemAsGroup -All | Where-Object DisplayName -eq "Project Falcon"
Restore-MgDirectoryDeletedItem -DirectoryObjectId "group-id"

Connect-MicrosoftTeams

# Create a custom policy
New-CsTeamsMeetingPolicy -Identity "Executive" `
    -AllowCloudRecording $false `
    -AllowMeetWatermark $true `
    -DesignatedPresenterRoleMode "OrganizerOnlyUserOverride"

# Assign to a user
Grant-CsTeamsMeetingPolicy -Identity exec@yourcompany.com -PolicyName "Executive"

Get-Mailbox | ForEach-Object {
    $newEmail = $_.Alias + "@newcompany.com"
    Set-Mailbox $_ -EmailAddresses @{Add=$newEmail}
    Set-Mailbox $_ -PrimarySmtpAddress $newEmail
}

Connect-PnPOnline -Url https://contoso.sharepoint.com/sites/Finance -Interactive
Get-PnPFileSharingLink -Identity "/sites/Finance/Shared Documents/Board" 
Get-PnPFolderSharingLink -Folder "Shared Documents/Board"

Connect-PnPOnline -Url https://contoso.sharepoint.com/sites/Finance -Interactive
Get-PnPRecycleBinItem -FirstStage | Where-Object DeletedByEmail -eq "user@contoso.com" | Where-Object DeletedDate -gt (Get-Date "2026-09-01 14:00") | Restore-PnPRecycleBinItem -Force

Connect-SPOService -Url https://contoso-admin.sharepoint.com
Set-SPOSite -Identity https://contoso.sharepoint.com/sites/Finance -SharingCapability Disabled
# Or: ExistingExternalUserSharingOnly | ExternalUserSharingOnly | ExternalUserAndGuestSharing