From delegated access to dependable directory reporting. Read-only Microsoft Graph automation, test-driven PowerShell development, and inspectable evidence.
Build reusable read-only Microsoft 365 reporting in PowerShell. Technologies: Microsoft.Graph.Authentication, delegated Graph scopes, REST GET requests, hashtable response handling, and CSV export.
The seven retained scripts cover tenant inventory, users, groups, licensing, directory roles, stale accounts, and Intune managed devices. Script inspection confirms reporting implementation. The tenant summary reads first-page collections without pagination for several counts; it is not presented as a complete large-tenant inventory solution.
Troubleshooting and code review
The notes document a role-members query returning 400 with a top parameter and a signInActivity request returning 403 without AuditLog.Read.All. The role script omits the problematic top parameter; stale-account and Intune scripts compare required scopes and reconnect. The original seven-script evidence review did not rerun these scripts against a tenant. Their historical live CSV output remains withheld. The newer JSON export was separately tested with mocked data and a point-in-time live directory retrieval.
02 / VERIFIED EXTENSION
Microsoft Graph development · Tested automation
A reusable, read-only PowerShell user inventory export now complements the seven retained administration scripts. The extension validates delegated User.Read.All access, retrieves directory users through Microsoft Graph, and generates a structured JSON report. Generated tenant reports remain excluded from the public repository.
PASS 8/8
Automated test validation
8/8PASSING
Validated locally with Pester 6.2.0 after merging into main: three function tests and five JSON report checks; zero failures and zero skipped. Tests use mocked Graph responses and synthetic records, rather than live tenant data.
A separate live delegated session retrieved 24 users at the time of testing. This is a point-in-time validation, not a claim about the tenant's current user count.
Four clear boundaries keep authentication, collection, reporting, and verification separate.
01 / EXECUTE
PS
PowerShell 7Script entry point
02 / AUTHORIZE
◎
Graph sessionDelegated User.Read.All
03 / RETRIEVE
≡
Directory usersGet-MgUser -All
04 / EXPORT
{ }
JSON reportLocal, ignored output
Pester tests exercise the authentication guards and report structure using mocked or synthetic data. Live tenant records are not committed to the site.
Scope and limitations
Read-only delegated administration/reporting is currently proven. Live CSV exports are intentionally not public because they may contain UPNs, object IDs, device identifiers, and tenant-specific data. Do not imply write automation or broader Graph coverage that has not been validated.
Registry status retained in the audit: COMPLETE — validated read-only Microsoft Graph administration and reporting automation. The new development extension adds independently executed Pester tests; the original evidence below remains preserved.
Eight preserved source artifacts, each linked to its original code or troubleshooting record. Expand provenance to inspect source paths and hashes.
ARTIFACT / 01SOURCE VERIFIED
Evidence 1
The supplied Get-EntraRoleInventory.ps1 implements read-only Graph reporting; retained documentation reports validation, while live CSV output is withheld.
Open Get-EntraRoleInventory.ps1confirmed code inspection of GET requests, scopes and reporting; source code does not independently prove successful live executionProvenance
The supplied Get-EntraStaleAccounts.ps1 implements read-only Graph reporting; retained documentation reports validation, while live CSV output is withheld.
Open Get-EntraStaleAccounts.ps1confirmed code inspection of GET requests, scopes and reporting; source code does not independently prove successful live executionProvenance
The supplied Get-IntuneManagedDeviceInventory.ps1 implements read-only Graph reporting; retained documentation reports validation, while live CSV output is withheld.
Open Get-IntuneManagedDeviceInventory.ps1confirmed code inspection of GET requests, scopes and reporting; source code does not independently prove successful live executionProvenance
The supplied Get-M365GroupMembership.ps1 implements read-only Graph reporting; retained documentation reports validation, while live CSV output is withheld.
Open Get-M365GroupMembership.ps1confirmed code inspection of GET requests, scopes and reporting; source code does not independently prove successful live executionProvenance
The supplied Get-M365LicenseAssignment.ps1 implements read-only Graph reporting; retained documentation reports validation, while live CSV output is withheld.
Open Get-M365LicenseAssignment.ps1confirmed code inspection of GET requests, scopes and reporting; source code does not independently prove successful live executionProvenance
The supplied Get-M365TenantInventory.ps1 implements read-only Graph reporting; retained documentation reports validation, while live CSV output is withheld.
Open Get-M365TenantInventory.ps1confirmed code inspection of GET requests, scopes and reporting; source code does not independently prove successful live executionProvenance
The supplied Get-M365UserInventory.ps1 implements read-only Graph reporting; retained documentation reports validation, while live CSV output is withheld.
Open Get-M365UserInventory.ps1confirmed code inspection of GET requests, scopes and reporting; source code does not independently prove successful live executionProvenance
