Microsoft Graph and PowerShell Scripts Aid Admins in Auditing M365 Accounts and Licenses
New PowerShell scripts leverage Microsoft Graph API to help administrators identify stale accounts and optimize license usage within Microsoft 365 environments.
Security administrators and IT professionals can now more effectively audit their Microsoft 365 environments for dormant accounts and underutilized licenses, thanks to a detailed guide on utilizing the Microsoft Graph API with PowerShell. The approach, detailed by the SANS Internet Storm Center, provides practical cmdlets to extract crucial user and license information, enabling better security posture and cost management.
The core of the technique involves querying user data through the Microsoft Graph API, a modern interface designed to replace older Microsoft APIs. The article highlights the necessity of using the -All parameter in Get-MgUser cmdlets to retrieve complete datasets, as the API defaults to returning only the first 100 objects. This ensures that administrators can gain a comprehensive view of their user base, rather than a partial snapshot.
Key information extracted includes user account status (enabled or disabled) and, critically, the last password change date. By sorting this data, administrators can pinpoint accounts that have not been accessed or updated for extended periods, which are often prime targets for compromise or simply represent unnecessary liabilities. The article provides specific commands to fetch LastPasswordChangeDateTime, making this audit straightforward.
Beyond account activity, the scripts delve into license management. By querying the assignedLicenses property and using Get-MgUserLicenseDetail, administrators can identify the specific license SKUs assigned to each user. The article demonstrates how to retrieve human-readable SkuPartNumber identifiers, such as 'SPE_E3' or 'Microsoft_365_Copilot', which are essential for understanding license allocation and identifying potential over-provisioning or unused licenses.
To streamline the process, the guide offers consolidated PowerShell commands that combine the retrieval of user details, last login dates (both interactive and non-interactive), and assigned licenses into a single output. This consolidated data can be exported to CSV files for further analysis in spreadsheet software or viewed interactively using Out-GridView. The ability to correlate last login times with license assignments provides a powerful tool for both security and operational efficiency.
While the article focuses on auditing for stale accounts and licenses, it hints at further security applications, suggesting that similar techniques can be employed to detect suspicious activity. The ability to programmatically access and analyze user and license data is fundamental for maintaining a secure and efficiently managed cloud environment.
This method empowers organizations to proactively manage their Microsoft 365 identity landscape. By identifying and addressing stale accounts, they can reduce their attack surface. Simultaneously, optimizing license usage can lead to significant cost savings, demonstrating the dual benefits of this administrative approach.