Microsoft 365 Graph Administration Lab

Microsoft 365 Graph Administration Lab

Status: COMPLETE — validated read-only Microsoft Graph administration and reporting automation.

Portfolio case study: https://jeremyfontenot.online/m365-graph-administration-lab.html

This lab demonstrates Microsoft 365, Microsoft Entra ID, Microsoft Intune, Microsoft Graph, and PowerShell administration using a Microsoft 365 E5 Developer tenant.

Objectives

• Build reusable Microsoft Graph administration tooling.
• Prefer read-only validation before configuration changes.
• Use delegated permissions with least-privilege scope selection.
• Exercise both Graph REST endpoints and PowerShell automation.
• Document authentication, permissions, API behavior, troubleshooting, and validation.
• Produce portfolio-quality evidence without creating meaningless tenant activity.

Validated scripts

Validated environment snapshot

• Verified domains: 3
• Users: 22
• Groups: 12
• Subscribed SKUs: 1
• Activated directory roles: 4
• Entra devices: 2
• Licensed users: 19
• Unlicensed users: 3
• Intune managed devices: 1

These values are a point-in-time lab snapshot and will change as the environment evolves.

Graph permissions exercised

• Organization.Read.All
• User.Read.All
• Group.Read.All
• Directory.Read.All
• AuditLog.Read.All
• DeviceManagementManagedDevices.Read.All

Graph endpoints exercised

GET /v1.0/organization
GET /v1.0/users
GET /v1.0/groups
GET /v1.0/groups/{id}/members
GET /v1.0/subscribedSkus
GET /v1.0/directoryRoles
GET /v1.0/directoryRoles/{id}/members
GET /v1.0/devices
GET /v1.0/deviceManagement/managedDevices

Validation highlights

• Device Code delegated authentication validated.
• Existing Graph sessions are checked for required scopes before reuse.
• Graph collection pagination is handled where supported.
• Windows PowerShell 5.1 hashtable behavior is handled explicitly.
• CSV reporting was validated for tenant, user, group, licensing, role, stale-account, and Intune inventory.
• A 400 Bad Request on directory-role membership was traced to an unsupported $top query parameter and corrected.
• A 403 Forbidden on signInActivity was traced to a missing AuditLog.Read.All scope and corrected.

Repository layout

m365-graph-administration-lab/
├── README.md
├── scripts/
│   ├── Get-M365TenantInventory.ps1
│   ├── Get-M365UserInventory.ps1
│   ├── Get-M365GroupMembership.ps1
│   ├── Get-M365LicenseAssignment.ps1
│   ├── Get-EntraRoleInventory.ps1
│   ├── Get-EntraStaleAccounts.ps1
│   └── Get-IntuneManagedDeviceInventory.ps1
└── docs/
    └── Troubleshooting.md

Completion and claim boundary

The intended portfolio scope is complete: seven read-only administration/reporting scripts were validated across Microsoft 365, Entra ID, and Intune. The project demonstrates delegated Microsoft Graph authentication, required-scope handling, read-only administration/reporting, CSV output, pagination, and documented troubleshooting. It does not claim Graph write automation or broader administrative coverage that was not validated.

Security and publication notes

Live CSV exports are intentionally not published because they can contain user principal names, object IDs, device identifiers, and other tenant-specific information. The public repository contains the reusable code and sanitized validation documentation only.

Troubleshooting Notes

Microsoft.Graph.Authentication missing

Installed the authentication module:

Install-Module Microsoft.Graph.Authentication -Scope CurrentUser -Force

Validated module version during the lab: 2.41.0.

PowerShell execution policy blocked module loading

Corrected the current-user policy:

Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned

Windows PowerShell 5.1 Graph response behavior

Invoke-MgGraphRequest responses behaved as hashtables in this environment, so key indexing was used where appropriate:

$Org["displayName"]

Single-object count behavior

Graph collections were explicitly wrapped with @(...) so .Count remained reliable when only one object was returned.

Session-scoped project root

Reusable scripts determine the project root from their own location:

$ProjectRoot = Split-Path $PSScriptRoot -Parent

Directory-role members returned 400 Bad Request

The role list succeeded, but calls shaped like:

GET /v1.0/directoryRoles/{id}/members?$top=999

returned 400 Bad Request.

Removing $top corrected the query:

GET /v1.0/directoryRoles/{id}/members

All activated roles were then processed successfully.

signInActivity returned 403 Forbidden

An existing Graph session lacked AuditLog.Read.All. The stale-account script was changed to compare the required scopes with Get-MgContext.Scopes and reconnect when a required scope was missing.

After reauthentication with:

User.Read.All
AuditLog.Read.All

the user sign-in activity query completed successfully.

Disconnect-MgGraph MSAL cache warning

Disconnect-MgGraph displayed an authority-format warning while clearing the persisted MSAL token cache. The warning did not prevent a successful new Device Code authentication session.

Intune managed-device permission

The Intune inventory required:

DeviceManagementManagedDevices.Read.All

The script detected the missing scope, reauthenticated, and successfully retrieved the managed-device inventory.