> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/cloud/microsoft-azure/microsoft-graph-powershell.md).

# Microsoft Graph PowerShell

The Microsoft Graph PowerShell SDK acts as an API wrapper for the Microsoft Graph APIs, exposing the entire API set for use in PowerShell. It contains a set of cmdlets that help you manage identities at scale from automating tasks to managing users in bulk using Microsoft Entra ID. It will help administer every Microsoft Entra feature that has an API in Microsoft Graph.

The commands in Microsoft Graph PowerShell are autogenerated from the Microsoft Graph API schema making it easier to get faster updates and functionality. The cmdlet reference content is also autogenerated from the API reference.

Microsoft Graph PowerShell is the replacement for the Azure AD PowerShell and MSOnline modules and is recommended for interacting with Microsoft Entra ID.

## Installation

[Install](https://learn.microsoft.com/en-us/powershell/microsoftgraph/installation?view=graph-powershell-1.0) the PowerShell module from an elevated shell with

```powershell
Install-Module Microsoft.Graph -Repository PSGallery -AllowClobber
```

## Import

Before using the module we need to import it

```powershell
Import-Module Microsoft.Graph
```

Please note that the module takes some time to import!

If you get a `cannot be created because function capacity 4096 has been exceeded for this scope` error message, increase the limit with

```powershell
$MaximumFunctionCount = '32768'
```

and try to import the module again.

## Connect

Connect with [Connect-MgGraph](https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.authentication/connect-mggraph?view=graph-powershell-1.0)

```powershell
Connect-MgGraph -NoWelcome
```

A Pop-up window will ask you for credentials.

## Enumeration

### List Groups

List users with [Get-MgGroup](https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.groups/get-mggroup?view=graph-powershell-1.0)

```powershell
Get-MgGroup -All | Select-Object *
```

Search for flag in the output

```powershell
Get-MgGroup -All | Select-Object * | findstr flag
```

### List Organization Info

List information about the organization with [Get-MgOrganization](https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.identity.directorymanagement/get-mgorganization?view=graph-powershell-1.0)

```powershell
Get-MgOrganization | Select-Object *
```

To get organization branding information with [Get-MgOrganizationBranding](https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.identity.directorymanagement/get-mgorganizationbranding?view=graph-powershell-1.0), use the `Id` from the output above

```powershell
Get-MgOrganizationBranding -OrganizationId 05985beb-42bc-4c24-bf49-c1730a825406 | Select-Object *
```

Search for flag in the output

```powershell
Get-MgOrganizationBranding -OrganizationId 05985beb-42bc-4c24-bf49-c1730a825406 | Select-Object * | findstr flag
```

### List Service Principles

List users with [Get-MgServicePrincipal](https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.applications/get-mgserviceprincipal?view=graph-powershell-1.0)

```powershell
Get-MgServicePrincipal -All | Select-Object *
```

Search for flag in the output

```powershell
Get-MgServicePrincipal -All | Select-Object * | findstr flag
```

### List Users

List users with [Get-MgUser](https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.users/get-mguser?view=graph-powershell-1.0)

```powershell
Get-MgUser -All | Select-Object *
```

Search for flag in the output

```powershell
Get-MgUser -All | Select-Object * | findstr flag
```

## Resources

Microsoft Graph PowerShell - Microsoft Learn: <https://learn.microsoft.com/en-us/powershell/microsoftgraph/overview?view=graph-powershell-1.0>

Microsoft Graph Cmdlet Reference - Microsoft Learn: <https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.applications/?view=graph-powershell-1.0>