Build Entra ID automation around Microsoft Graph objects

Overview

This track teaches you to automate Entra ID (formerly Azure AD) with Microsoft Graph PowerShell. You'll go from connecting to your tenant, through user and group management, to application identities and safe lifecycle automation.

What you'll learn: Connecting to Graph, querying users and groups, creating and updating accounts, managing group membership, working with roles, and building safe automation that follows least-privilege principles.

Prerequisites: Basic PowerShell (variables, pipelines, cmdlets). An Entra ID tenant with admin access for hands-on practice. The Microsoft Graph PowerShell module installed: Install-Module Microsoft.Graph -Scope CurrentUser.

Lesson 1: Connect to Microsoft Graph

Every Graph PowerShell session starts with Connect-MgGraph. You specify scopes — the permissions your session needs. Always request the minimum scopes for the task.

Connect-MgGraph -Scopes "User.Read.All","Group.Read.All"
# Verify your connection:
Get-MgContext
# Check what scopes you have:
(Get-MgContext).Scopes

Delegated vs app-only: Delegated access runs as you (your permissions). App-only access uses a registered application with its own credentials — better for scheduled automation, but requires admin consent.

Exercise: Connect with read-only scopes. Run Get-MgContext and confirm your tenant ID matches your organization.

Lesson 2: Query Users

List users with Get-MgUser. By default it returns only a few properties — use -Property to get more, and -Filter to narrow results server-side (much faster than piping to Where-Object).

# All users (first page)
Get-MgUser -Top 10

# Filter server-side: only enabled accounts
Get-MgUser -Filter "accountEnabled eq true" -Property DisplayName,UserPrincipalName,JobTitle

# Find a specific user
Get-MgUser -Filter "startswith(displayName,'Priya')"

# Get all properties for one user
Get-MgUser -UserId "priya@contoso.com" -Property Id,DisplayName,Department,Manager

Exercise: List all users in your tenant. Then filter to only users in the IT department. Count how many enabled vs disabled accounts exist.

Lesson 3: Create and Update Users

Creating a user requires a display name, mail nickname, user principal name, and a password profile.

$password = @{
    Password = "TempPass123!"
    ForceChangePasswordNextSignIn = $true
}
New-MgUser -DisplayName "Aarav Sharma" `
    -MailNickname "aarav" `
    -UserPrincipalName "aarav@contoso.com" `
    -PasswordProfile $password `
    -AccountEnabled:$true

# Update a user's job title and department
Update-MgUser -UserId "aarav@contoso.com" -JobTitle "Systems Engineer" -Department "IT"

# Disable an account (safer than deleting)
Update-MgUser -UserId "aarav@contoso.com" -AccountEnabled:$false

Exercise: Create a test user. Update their department. Then disable the account. Verify each step with Get-MgUser.

Lesson 4: Manage Groups

Groups control access. Security groups are for permissions; Microsoft 365 groups are for collaboration (Teams, SharePoint).

# Create a security group
New-MgGroup -DisplayName "IT Admins" -MailEnabled:$false `
    -SecurityEnabled:$true -MailNickname "itadmins"

# Add a member
New-MgGroupMember -GroupId "group-id-here" -DirectoryObjectId "user-id-here"

# List group members
Get-MgGroupMember -GroupId "group-id-here" | Select-Object DisplayName

# Remove a member
Remove-MgGroupMember -GroupId "group-id-here" -DirectoryObjectId "user-id-here"

Exercise: Create a group called "PowerShell Learners". Add three test users. List the members to confirm. Remove one member.

Lesson 5: Role Assignments

Entra ID roles (like Global Administrator, User Administrator) are assigned through role management cmdlets. Always use PIM (Privileged Identity Management) for admin roles when available.

# List available role definitions
Get-MgRoleManagementDirectoryRoleDefinition | Select-Object DisplayName,Id

# Assign a role (permanent — use PIM for production)
New-MgRoleManagementDirectoryRoleAssignment -PrincipalId "user-id" `
    -RoleDefinitionId "role-id" -DirectoryScopeId "/"

# List current assignments for a user
Get-MgRoleManagementDirectoryRoleAssignment -Filter "principalId eq 'user-id'"

Lesson 6: Safe Lifecycle Automation

Real-world automation: when someone joins, create their account, add them to groups, and assign a license. When they leave, disable (don't delete immediately), remove from groups, and revoke sessions.

# Offboarding script pattern
$userId = "leaving-user@contoso.com"

# 1. Disable the account
Update-MgUser -UserId $userId -AccountEnabled:$false

# 2. Remove from all groups
Get-MgUserMemberOf -UserId $userId | ForEach-Object {
    Remove-MgGroupMember -GroupId $_.Id -DirectoryObjectId (Get-MgUser -UserId $userId).Id
}

# 3. Revoke all sessions
Revoke-MgUserSignInSession -UserId $userId

Write-Host "Offboarding complete for $userId"

Final exercise: Write a script that takes a CSV of new hires (name, department, manager) and creates their accounts, adds them to the right department group, and logs every action to a file.