Microsoft 365 Graph Administration Lab

Status: COMPLETE — validated read-only Microsoft Graph administration and reporting automation.

Portfolio case study: https://jeremyfontenot.online/m365-graph-administration-lab.html

This lab demonstrates Microsoft 365, Microsoft Entra ID, Microsoft Intune, Microsoft Graph, and PowerShell administration using a Microsoft 365 E5 Developer tenant.

Objectives

Build reusable Microsoft Graph administration tooling.
Prefer read-only validation before configuration changes.
Use delegated permissions with least-privilege scope selection.
Exercise both Graph REST endpoints and PowerShell automation.
Document authentication, permissions, API behavior, troubleshooting, and validation.
Produce portfolio-quality evidence without creating meaningless tenant activity.

Validated scripts

Script	Purpose	Status
`Get-M365TenantInventory.ps1`	Tenant, domain, user, group, SKU, role, and Entra-device inventory	Validated
`Get-M365UserInventory.ps1`	Detailed Entra/M365 user and licensing inventory	Validated
`Get-M365GroupMembership.ps1`	Group and direct-membership reporting	Validated
`Get-M365LicenseAssignment.ps1`	License capacity and assignment reporting	Validated
`Get-EntraRoleInventory.ps1`	Activated Entra directory roles and membership	Validated
`Get-EntraStaleAccounts.ps1`	Potentially stale account analysis using sign-in activity	Validated
`Get-IntuneManagedDeviceInventory.ps1`	Intune managed-device inventory	Validated

Validated environment snapshot

Verified domains: 3
Users: 22
Groups: 12
Subscribed SKUs: 1
Activated directory roles: 4
Entra devices: 2
Licensed users: 19
Unlicensed users: 3
Intune managed devices: 1

These values are a point-in-time lab snapshot and will change as the environment evolves.

Graph permissions exercised

Organization.Read.All
User.Read.All
Group.Read.All
Directory.Read.All
AuditLog.Read.All
DeviceManagementManagedDevices.Read.All

Graph endpoints exercised

GET /v1.0/organization
GET /v1.0/users
GET /v1.0/groups
GET /v1.0/groups/{id}/members
GET /v1.0/subscribedSkus
GET /v1.0/directoryRoles
GET /v1.0/directoryRoles/{id}/members
GET /v1.0/devices
GET /v1.0/deviceManagement/managedDevices

Validation highlights

Device Code delegated authentication validated.
Existing Graph sessions are checked for required scopes before reuse.
Graph collection pagination is handled where supported.
Windows PowerShell 5.1 hashtable behavior is handled explicitly.
CSV reporting was validated for tenant, user, group, licensing, role, stale-account, and Intune inventory.
A 400 Bad Request on directory-role membership was traced to an unsupported $top query parameter and corrected.
A 403 Forbidden on signInActivity was traced to a missing AuditLog.Read.All scope and corrected.

Repository layout

m365-graph-administration-lab/
├── README.md
├── scripts/
│   ├── Get-M365TenantInventory.ps1
│   ├── Get-M365UserInventory.ps1
│   ├── Get-M365GroupMembership.ps1
│   ├── Get-M365LicenseAssignment.ps1
│   ├── Get-EntraRoleInventory.ps1
│   ├── Get-EntraStaleAccounts.ps1
│   └── Get-IntuneManagedDeviceInventory.ps1
└── docs/
    └── Troubleshooting.md

Completion and claim boundary

The intended portfolio scope is complete: seven read-only administration/reporting scripts were validated across Microsoft 365, Entra ID, and Intune. The project demonstrates delegated Microsoft Graph authentication, required-scope handling, read-only administration/reporting, CSV output, pagination, and documented troubleshooting. It does not claim Graph write automation or broader administrative coverage that was not validated.

Security and publication notes

Live CSV exports are intentionally not published because they can contain user principal names, object IDs, device identifiers, and other tenant-specific information. The public repository contains the reusable code and sanitized validation documentation only.