1
00:00:00,040 --> 00:00:04,000
Welcome to the M365 FM podcast,
where we explore the people,

2
00:00:04,000 --> 00:00:07,080
ideas and technologies shaping
the future of work.

3
00:00:07,080 --> 00:00:10,119
What the Microsoft Graph
PowerShell SDK actually is.

4
00:00:10,119 --> 00:00:13,560
Microsoft retired two of the
admin modules that PowerShell

5
00:00:13,560 --> 00:00:16,719
scripts relied on for years, and
the replacement is friendlier

6
00:00:16,719 --> 00:00:18,399
than it sounds.

7
00:00:18,399 --> 00:00:21,960
That replacement is the
Microsoft Graph PowerShell SDK,

8
00:00:21,960 --> 00:00:25,160
the same Microsoft Graph layer
that sits behind a lot of the

9
00:00:25,160 --> 00:00:26,440
admin tools you already.

10
00:00:26,440 --> 00:00:26,920
Click.

11
00:00:26,920 --> 00:00:30,160
Welcome to the M365 FM podcast,
where we explore the people,

12
00:00:30,160 --> 00:00:32,759
ideas, and technologies shaping
the future of work.

13
00:00:32,759 --> 00:00:34,000
You don't need to be a developer

14
00:00:34,000 --> 00:00:35,240
to use it, and you don't need to

15
00:00:35,240 --> 00:00:36,520
memorize anything before we

16
00:00:36,520 --> 00:00:36,799
start.

17
00:00:36,799 --> 00:00:38,000
By the end, you'll know what it

18
00:00:38,000 --> 00:00:39,320
does, where it fits in Microsoft

19
00:00:39,320 --> 00:00:39,520
three.

20
00:00:39,520 --> 00:00:40,799
Sixty five and Azure and the

21
00:00:40,799 --> 00:00:41,960
mistakes that trip almost

22
00:00:41,960 --> 00:00:42,719
everyone up.

23
00:00:42,719 --> 00:00:44,119
Let's start with the plain
version.

24
00:00:44,119 --> 00:00:47,719
The Microsoft Graph PowerShell
SDK is a large set of commands

25
00:00:47,719 --> 00:00:50,679
you type into PowerShell window,
and those commands do real

26
00:00:50,679 --> 00:00:52,320
Microsoft three hundred sixty
five work for you?

27
00:00:52,320 --> 00:00:53,439
That's the whole idea.

28
00:00:53,439 --> 00:00:55,159
Microsoft builds it as a wrapper

29
00:00:55,159 --> 00:00:56,039
around something called

30
00:00:56,039 --> 00:00:56,920
Microsoft Graph.

31
00:00:56,920 --> 00:00:59,719
The commands are a friendly
layer on top of an interface you

32
00:00:59,719 --> 00:01:01,359
never have to touch by hand.

33
00:01:01,359 --> 00:01:04,250
One detail makes that rapper
feel less mysterious.

34
00:01:04,250 --> 00:01:05,290
The commands are generated

35
00:01:05,290 --> 00:01:06,450
straight from the Microsoft

36
00:01:06,450 --> 00:01:07,530
Graph interface.

37
00:01:07,530 --> 00:01:10,409
When Microsoft adds something
new to the platform, a matching

38
00:01:10,409 --> 00:01:12,010
command tends to appear quickly.

39
00:01:12,010 --> 00:01:13,290
You're not learning a frozen

40
00:01:13,290 --> 00:01:14,250
tool, you're learning one that

41
00:01:14,250 --> 00:01:15,489
keeps pace with the service

42
00:01:15,489 --> 00:01:16,250
behind it.

43
00:01:16,250 --> 00:01:18,650
The admin center is probably
what you picture for managing

44
00:01:18,650 --> 00:01:21,129
Microsoft three hundred sixty
five, and for a single small

45
00:01:21,129 --> 00:01:22,209
change, it works well.

46
00:01:22,209 --> 00:01:23,769
The SDK earns its place when the

47
00:01:23,769 --> 00:01:25,030
same small change has to happen

48
00:01:25,030 --> 00:01:26,329
a thousand times the same way,

49
00:01:26,329 --> 00:01:27,370
without anyone forgetting a

50
00:01:27,370 --> 00:01:27,969
step.

51
00:01:27,969 --> 00:01:30,010
Picture adding two hundred new
starters next month.

52
00:01:30,010 --> 00:01:31,209
Clicking through menus for every

53
00:01:31,209 --> 00:01:32,730
one of them eats an afternoon

54
00:01:32,730 --> 00:01:34,010
while a short script finishes

55
00:01:34,010 --> 00:01:35,170
the job before your coffee goes

56
00:01:35,170 --> 00:01:35,609
cold.

57
00:01:35,609 --> 00:01:38,650
The name is the scariest part,
so it deserves taking apart.

58
00:01:38,650 --> 00:01:40,689
SDK stands for Software
Development Kit.

59
00:01:40,689 --> 00:01:42,890
That sounds like it belongs to
programmers, but in this case,

60
00:01:42,890 --> 00:01:46,469
the kit is just commands with
ordinary verbs like get, new,

61
00:01:46,469 --> 00:01:47,609
set, and remove.

62
00:01:47,609 --> 00:01:49,930
If you have ever typed a command
into a terminal, you already

63
00:01:49,930 --> 00:01:51,090
have the muscle for this.

64
00:01:51,090 --> 00:01:52,450
It also runs almost anywhere.

65
00:01:52,450 --> 00:01:53,409
The same commands work on

66
00:01:53,409 --> 00:01:55,290
windows, on a Mac and on Linux,

67
00:01:55,290 --> 00:01:56,329
and they run in both modern

68
00:01:56,329 --> 00:01:57,769
PowerShell seven and the older

69
00:01:57,769 --> 00:01:59,030
windows PowerShell five point

70
00:01:59,030 --> 00:02:00,209
one that ships with many

71
00:02:00,209 --> 00:02:00,890
machines.

72
00:02:00,890 --> 00:02:03,495
That range matters because a
script you write on your laptop

73
00:02:03,495 --> 00:02:06,140
can run on a server later
without being rewritten.

74
00:02:06,140 --> 00:02:08,740
There's a practical reason to
care beyond curiosity.

75
00:02:08,740 --> 00:02:11,699
Microsoft made this the official
replacement for the older tools,

76
00:02:11,699 --> 00:02:14,180
so it's the direction the entire
platform is moving.

77
00:02:14,180 --> 00:02:15,379
Learning it now means learning

78
00:02:15,379 --> 00:02:16,479
the language that Microsoft

79
00:02:16,479 --> 00:02:16,699
three.

80
00:02:16,699 --> 00:02:18,819
Sixty five and Azure are
increasingly written in.

81
00:02:18,819 --> 00:02:21,020
And that's a real line on a
resume.

82
00:02:21,020 --> 00:02:22,939
The single front door that is
Microsoft Graph.

83
00:02:22,939 --> 00:02:25,379
Underneath the commands sits
Microsoft Graph.

84
00:02:25,379 --> 00:02:26,419
Understanding it makes

85
00:02:26,419 --> 00:02:27,460
everything else click into

86
00:02:27,460 --> 00:02:27,979
place.

87
00:02:27,979 --> 00:02:30,500
Microsoft Graph is one front
door with one key.

88
00:02:30,500 --> 00:02:31,580
Instead of learning a different

89
00:02:31,580 --> 00:02:32,699
address and a different login

90
00:02:32,699 --> 00:02:34,319
for every Microsoft service, you

91
00:02:34,319 --> 00:02:35,580
learn a single address and a

92
00:02:35,580 --> 00:02:36,680
single key that opens the whole

93
00:02:36,680 --> 00:02:37,379
building.

94
00:02:37,379 --> 00:02:40,139
A couple of those words deserve
plain definitions.

95
00:02:40,139 --> 00:02:41,099
The address is called an

96
00:02:41,099 --> 00:02:42,340
endpoint, which is just the web

97
00:02:42,340 --> 00:02:43,860
location your command sends its

98
00:02:43,860 --> 00:02:44,699
request to.

99
00:02:44,699 --> 00:02:45,939
The key is called a token.

100
00:02:45,939 --> 00:02:48,500
A small, short lived pass that
proves you're allowed in.

101
00:02:48,500 --> 00:02:50,180
The SDK handles both of them for

102
00:02:50,180 --> 00:02:51,460
you, so you rarely see them at

103
00:02:51,460 --> 00:02:51,900
all.

104
00:02:51,900 --> 00:02:54,620
The commands themselves are
generated from that interface,

105
00:02:54,620 --> 00:02:55,860
so they follow a steady pattern.

106
00:02:55,860 --> 00:02:56,620
You can predict.

107
00:02:56,620 --> 00:03:00,340
Get user reads users new user
creates one set user changes one

108
00:03:00,340 --> 00:03:02,099
and remove user deletes one.

109
00:03:02,099 --> 00:03:04,979
The little egg in the middle is
shorthand for Microsoft Graph.

110
00:03:04,979 --> 00:03:07,800
Once you can read one command,
you can make a solid guess at

111
00:03:07,800 --> 00:03:08,939
hundreds of others.

112
00:03:08,939 --> 00:03:12,060
What makes graph special is the
reach that same single address

113
00:03:12,060 --> 00:03:13,699
and single key open entry ID.

114
00:03:13,699 --> 00:03:15,240
The new name for Azure AD Plus,

115
00:03:15,240 --> 00:03:16,900
SharePoint exchange, outlook and

116
00:03:16,900 --> 00:03:17,259
teams.

117
00:03:17,259 --> 00:03:18,819
This is why one tool can list

118
00:03:18,819 --> 00:03:20,139
your users, pull their mail

119
00:03:20,139 --> 00:03:21,819
settings, and post into a teams

120
00:03:21,819 --> 00:03:23,039
channel without you juggling

121
00:03:23,039 --> 00:03:24,659
five separate logins for a

122
00:03:24,659 --> 00:03:25,259
beginner.

123
00:03:25,259 --> 00:03:27,099
The win is simpler than it first
appears.

124
00:03:27,099 --> 00:03:30,139
You stop hunting through menus
to answer basic questions.

125
00:03:30,139 --> 00:03:32,219
A count of every user is one
command.

126
00:03:32,219 --> 00:03:34,939
A list of accounts that haven't
signed in for ninety days is one

127
00:03:34,939 --> 00:03:36,460
command plus a filter.

128
00:03:36,460 --> 00:03:39,259
The data is the same data you
see in the portal, only now you

129
00:03:39,259 --> 00:03:40,740
can reach it by typing.

130
00:03:40,740 --> 00:03:41,699
There's a small trick worth

131
00:03:41,699 --> 00:03:42,860
remembering for those counting

132
00:03:42,860 --> 00:03:43,460
jobs.

133
00:03:43,460 --> 00:03:44,419
You can ask graph for a

134
00:03:44,419 --> 00:03:45,740
near-instant count of an entire

135
00:03:45,740 --> 00:03:47,139
collection, which turns the

136
00:03:47,139 --> 00:03:48,500
question of how many users we

137
00:03:48,500 --> 00:03:49,819
have into an answer that arrives

138
00:03:49,819 --> 00:03:50,740
right away.

139
00:03:50,740 --> 00:03:52,659
Instead of a slow scroll through
pages.

140
00:03:52,659 --> 00:03:55,860
It's a tiny feature that changes
how you think about big lists.

141
00:03:55,860 --> 00:03:58,180
Hold on to that idea because it
explains something bigger later

142
00:03:58,180 --> 00:04:00,860
on, which is why Microsoft had
to shut the old modules down in

143
00:04:00,860 --> 00:04:01,979
the first place.

144
00:04:01,979 --> 00:04:04,460
How you sign in and what
permissions really mean.

145
00:04:04,460 --> 00:04:07,389
Everything begins with a single
command called connect M graph,

146
00:04:07,389 --> 00:04:08,710
and it does two jobs at once.

147
00:04:08,710 --> 00:04:09,750
It asks you which permissions

148
00:04:09,750 --> 00:04:11,229
you want, and then it opens a

149
00:04:11,229 --> 00:04:12,389
sign in page where you approve

150
00:04:12,389 --> 00:04:12,870
them.

151
00:04:12,870 --> 00:04:14,750
That approval step is called
consent.

152
00:04:14,750 --> 00:04:16,029
It's the moment you decide what

153
00:04:16,029 --> 00:04:17,029
this session is allowed to

154
00:04:17,029 --> 00:04:17,670
touch.

155
00:04:17,670 --> 00:04:19,990
Permissions are the part people
rush, and they're also the part

156
00:04:19,990 --> 00:04:22,189
that matters most in the SDK.

157
00:04:22,189 --> 00:04:23,670
Nothing is handed to you in
advance.

158
00:04:23,670 --> 00:04:24,990
You request exactly what you

159
00:04:24,990 --> 00:04:26,990
need, which means a script built

160
00:04:26,990 --> 00:04:28,470
to read user profiles can't

161
00:04:28,470 --> 00:04:30,189
quietly go and delete mailboxes

162
00:04:30,189 --> 00:04:31,430
because it was never given the

163
00:04:31,430 --> 00:04:32,149
right to.

164
00:04:32,149 --> 00:04:34,029
A concrete example makes the
idea stick.

165
00:04:34,029 --> 00:04:36,750
If your only goal is a report of
who is in the tenant, you ask

166
00:04:36,750 --> 00:04:39,550
for a read only permission over
user profiles and nothing else.

167
00:04:39,550 --> 00:04:42,069
That one decision means the
worst thing the script can do is

168
00:04:42,069 --> 00:04:44,670
read, no matter what goes wrong
later in the code.

169
00:04:44,670 --> 00:04:48,029
There are two ways to sign in,
and the difference deserves 10s

170
00:04:48,029 --> 00:04:49,149
of your attention.

171
00:04:49,149 --> 00:04:52,230
Delegated access means you log
in as yourself, so the tool can

172
00:04:52,230 --> 00:04:54,350
only do what you could already
do by hand.

173
00:04:54,350 --> 00:04:57,269
App only access means there is
no human at the keyboard, which

174
00:04:57,269 --> 00:04:59,589
is exactly what you want for a
job that runs at two in the

175
00:04:59,589 --> 00:05:01,189
morning while everyone sleeps.

176
00:05:01,189 --> 00:05:02,589
Big permissions usually need an

177
00:05:02,589 --> 00:05:04,110
administrator to approve them

178
00:05:04,110 --> 00:05:05,350
the first time you request a new

179
00:05:05,350 --> 00:05:07,069
one, the consent screen appears

180
00:05:07,069 --> 00:05:08,360
and someone with the right role

181
00:05:08,360 --> 00:05:08,680
clicks.

182
00:05:08,680 --> 00:05:10,079
Yes, and many tenants.

183
00:05:10,079 --> 00:05:12,439
That means a privileged role
administrator.

184
00:05:12,439 --> 00:05:13,680
After that, the tenant remembers

185
00:05:13,680 --> 00:05:14,560
the approval, so you don't

186
00:05:14,560 --> 00:05:15,000
repeat it.

187
00:05:15,000 --> 00:05:15,759
Every session.

188
00:05:15,759 --> 00:05:17,240
One helper is worth knowing
early.

189
00:05:17,240 --> 00:05:19,600
Find Mograph command takes any
command and tells you which

190
00:05:19,600 --> 00:05:20,680
permissions it needs.

191
00:05:20,680 --> 00:05:21,920
So instead of guessing between

192
00:05:21,920 --> 00:05:23,360
read access and write access,

193
00:05:23,360 --> 00:05:24,959
you ask the tool a companion

194
00:05:24,959 --> 00:05:25,519
command.

195
00:05:25,519 --> 00:05:28,079
Find Mograph permission works
the other way around, starting

196
00:05:28,079 --> 00:05:30,439
from a permission and showing
you what it unlocks.

197
00:05:30,439 --> 00:05:31,439
The other half of the story is

198
00:05:31,439 --> 00:05:32,720
discipline because you stay

199
00:05:32,720 --> 00:05:33,720
signed in for the entire

200
00:05:33,720 --> 00:05:34,399
session.

201
00:05:34,399 --> 00:05:35,800
A powerful session left open on

202
00:05:35,800 --> 00:05:37,319
a shared machine is a loose end,

203
00:05:37,319 --> 00:05:39,040
and closing it takes one command

204
00:05:39,040 --> 00:05:39,519
disconnect.

205
00:05:39,519 --> 00:05:40,680
Mograph ends the session and

206
00:05:40,680 --> 00:05:42,040
throws away the token, which is

207
00:05:42,040 --> 00:05:43,199
a habit to build from your very

208
00:05:43,199 --> 00:05:44,319
first script.

209
00:05:44,319 --> 00:05:47,199
Your first commands from listing
users to messaging teams.

210
00:05:47,199 --> 00:05:48,279
Once you're signed in, the

211
00:05:48,279 --> 00:05:49,399
commands read almost like

212
00:05:49,399 --> 00:05:50,199
sentences.

213
00:05:50,199 --> 00:05:53,160
Everyone starts with a familiar
verb, then the letters mg.

214
00:05:53,160 --> 00:05:55,920
Then the thing you're working
with get reads new creates, set

215
00:05:55,920 --> 00:05:58,959
changes, and remove deletes so
the shape stays consistent no

216
00:05:58,959 --> 00:06:00,240
matter what you point it at.

217
00:06:00,240 --> 00:06:03,000
Begin with the simplest command
to feel the pattern.

218
00:06:03,000 --> 00:06:06,240
Get em user returns the people
in your organization, and if

219
00:06:06,240 --> 00:06:08,480
that list runs long, you narrow
it with a filter.

220
00:06:08,480 --> 00:06:11,009
A filter is just a plain
condition written in quotes,

221
00:06:11,009 --> 00:06:12,970
something like the user
principal name matching, a

222
00:06:12,970 --> 00:06:16,050
specific email address, and the
command hands back the match.

223
00:06:16,050 --> 00:06:19,490
From there, you can walk a chain
of relationships, which is where

224
00:06:19,490 --> 00:06:20,889
the real power shows up.

225
00:06:20,889 --> 00:06:23,769
Ask for a user, then ask which
teams they belong to.

226
00:06:23,769 --> 00:06:26,930
Then list the channels inside
one of those teams and then post

227
00:06:26,930 --> 00:06:28,290
a message into a channel.

228
00:06:28,290 --> 00:06:29,810
Each step reuses the identifier

229
00:06:29,810 --> 00:06:31,170
from the step before, so the

230
00:06:31,170 --> 00:06:32,290
commands link together like

231
00:06:32,290 --> 00:06:32,810
that.

232
00:06:32,810 --> 00:06:34,490
That last example shows the
range.

233
00:06:34,490 --> 00:06:35,730
In one short sequence, you moved

234
00:06:35,730 --> 00:06:37,569
from identity to collaboration

235
00:06:37,569 --> 00:06:39,129
to communication, all with the

236
00:06:39,129 --> 00:06:40,449
same sign in and the same style

237
00:06:40,449 --> 00:06:41,209
of command.

238
00:06:41,209 --> 00:06:42,290
Nothing about the syntax

239
00:06:42,290 --> 00:06:43,689
changed, even though the work

240
00:06:43,689 --> 00:06:44,290
did.

241
00:06:44,290 --> 00:06:46,810
One distinction keeps you out of
trouble because reads and writes

242
00:06:46,810 --> 00:06:48,050
carry different risk.

243
00:06:48,050 --> 00:06:50,769
A read pulls information back
and needs a read permission.

244
00:06:50,769 --> 00:06:52,290
A write creates or changes

245
00:06:52,290 --> 00:06:53,329
something and needs a write

246
00:06:53,329 --> 00:06:54,649
permission, which is usually

247
00:06:54,649 --> 00:06:56,189
where the consent screen appears

248
00:06:56,189 --> 00:06:56,529
again.

249
00:06:56,529 --> 00:06:58,689
You can also shape the answer
before it arrives.

250
00:06:58,689 --> 00:07:01,329
Request only the columns you
need and the response gets

251
00:07:01,329 --> 00:07:03,769
smaller and faster, which
matters a great deal.

252
00:07:03,769 --> 00:07:05,569
Once a list runs into the
thousands.

253
00:07:05,569 --> 00:07:06,610
When the work is done.

254
00:07:06,610 --> 00:07:07,170
Disconnect.

255
00:07:07,170 --> 00:07:09,860
McGruff signs you out and ends
the session cleanly.

256
00:07:09,860 --> 00:07:11,100
There's an honest limit here.

257
00:07:11,100 --> 00:07:13,980
Query options vary from one
command to the next, and some

258
00:07:13,980 --> 00:07:16,540
filters only work when you add
an extra setting that tells

259
00:07:16,540 --> 00:07:18,939
graph to be patient with large
amounts of data.

260
00:07:18,939 --> 00:07:20,339
If a filter seems to do nothing

261
00:07:20,339 --> 00:07:21,579
at all, it may be failing

262
00:07:21,579 --> 00:07:22,180
quietly.

263
00:07:22,180 --> 00:07:24,300
Always glance at what actually
came back.

264
00:07:24,300 --> 00:07:26,740
The everyday admin jobs it
quietly replaces.

265
00:07:26,740 --> 00:07:28,199
This is the point where the SDK

266
00:07:28,199 --> 00:07:29,819
stops being a curiosity and

267
00:07:29,819 --> 00:07:30,620
starts giving you your

268
00:07:30,620 --> 00:07:31,579
afternoons back.

269
00:07:31,579 --> 00:07:33,500
Let me walk through the jobs it
handles best.

270
00:07:33,500 --> 00:07:35,180
Onboarding is the classic one.

271
00:07:35,180 --> 00:07:37,860
Someone in HR sends you a
spreadsheet of new starters, and

272
00:07:37,860 --> 00:07:40,819
instead of creating each account
by hand, a script reads the file

273
00:07:40,819 --> 00:07:42,139
and creates them in a loop.

274
00:07:42,139 --> 00:07:45,019
It handles two hundred accounts
in a single run with no typos

275
00:07:45,019 --> 00:07:48,300
from tired copy and paste
licenses come next, and they're

276
00:07:48,300 --> 00:07:49,379
where the money hides.

277
00:07:49,379 --> 00:07:52,019
Every Microsoft three hundred
sixty five license has a cost,

278
00:07:52,019 --> 00:07:54,620
and most organizations have
people holding licenses.

279
00:07:54,620 --> 00:07:57,779
They no longer use a short
script, lists who has what, and

280
00:07:57,779 --> 00:08:00,540
a matching script assigns or
removes licenses in bulk.

281
00:08:00,540 --> 00:08:01,620
That's the sort of finding that

282
00:08:01,620 --> 00:08:02,500
turns up in a finance

283
00:08:02,500 --> 00:08:03,100
conversation.

284
00:08:03,100 --> 00:08:05,860
Cleanup is the third job, and
it's the job everyone avoids.

285
00:08:05,860 --> 00:08:06,939
The list includes accounts

286
00:08:06,939 --> 00:08:08,180
belonging to people who left

287
00:08:08,180 --> 00:08:09,860
shared mailboxes nobody owns,

288
00:08:09,860 --> 00:08:11,180
and groups with no members left

289
00:08:11,180 --> 00:08:11,899
in them.

290
00:08:11,899 --> 00:08:13,459
The SDK finds that mess quickly

291
00:08:13,459 --> 00:08:14,699
because it can filter and count

292
00:08:14,699 --> 00:08:16,060
across thousands of objects in

293
00:08:16,060 --> 00:08:16,819
seconds.

294
00:08:16,819 --> 00:08:18,819
Teams provisioning is another
quiet favorite.

295
00:08:18,819 --> 00:08:21,360
When a new project starts,
someone has to create the team,

296
00:08:21,360 --> 00:08:24,180
add the right people, and set up
a few standard channels.

297
00:08:24,180 --> 00:08:26,740
A script can do all of it the
same way every time.

298
00:08:26,740 --> 00:08:27,920
That consistency is worth more

299
00:08:27,920 --> 00:08:29,100
than the saved clicks because

300
00:08:29,100 --> 00:08:30,100
nobody has to remember the

301
00:08:30,100 --> 00:08:30,779
checklist.

302
00:08:30,779 --> 00:08:33,059
Then there's the superpower of
running it unattended.

303
00:08:33,059 --> 00:08:34,220
You can host a script in Azure

304
00:08:34,220 --> 00:08:35,299
Automation and let a managed

305
00:08:35,299 --> 00:08:36,539
identity sign in for it, which

306
00:08:36,539 --> 00:08:37,539
means there's no password

307
00:08:37,539 --> 00:08:38,580
sitting in the file for someone

308
00:08:38,580 --> 00:08:39,379
to find.

309
00:08:39,379 --> 00:08:42,179
It runs on a schedule, does its
work, and leaves a report where

310
00:08:42,179 --> 00:08:42,940
you asked for it.

311
00:08:42,940 --> 00:08:44,899
Put those together and a pattern
appears.

312
00:08:44,899 --> 00:08:46,460
The SDK is at its best when a

313
00:08:46,460 --> 00:08:47,980
task is repetitive, when it

314
00:08:47,980 --> 00:08:49,019
touches a lot of records, or

315
00:08:49,019 --> 00:08:50,019
when it has to happen on a

316
00:08:50,019 --> 00:08:50,419
schedule.

317
00:08:50,419 --> 00:08:51,740
Whether or not anyone is awake.

318
00:08:51,740 --> 00:08:52,820
And that's the real upside.

319
00:08:52,820 --> 00:08:55,220
The catch is that a handful of
habits bite back if you get

320
00:08:55,220 --> 00:08:57,899
careless, and those are exactly
the ones I want to put in front

321
00:08:57,899 --> 00:08:59,100
of you next.

322
00:08:59,100 --> 00:09:01,779
The mistakes and limits that
catch almost everyone.

323
00:09:01,779 --> 00:09:03,299
Now, the honest part, because

324
00:09:03,299 --> 00:09:04,460
this is where beginners get

325
00:09:04,460 --> 00:09:05,019
burned.

326
00:09:05,019 --> 00:09:06,080
None of these are reasons to

327
00:09:06,080 --> 00:09:07,700
avoid the SDK, but all of them

328
00:09:07,700 --> 00:09:08,940
are reasons to slow down at the

329
00:09:08,940 --> 00:09:09,340
start.

330
00:09:09,340 --> 00:09:10,740
The first trap is permissions

331
00:09:10,740 --> 00:09:11,860
piling up without anyone

332
00:09:11,860 --> 00:09:13,350
noticing When you sign in

333
00:09:13,350 --> 00:09:14,990
interactively, the SDK uses a

334
00:09:14,990 --> 00:09:16,490
Microsoft app called Microsoft

335
00:09:16,490 --> 00:09:18,230
Graph Command Line Tools, and

336
00:09:18,230 --> 00:09:19,490
every new permission you approve

337
00:09:19,490 --> 00:09:20,789
gets added to that app for your

338
00:09:20,789 --> 00:09:21,629
whole tenant.

339
00:09:21,629 --> 00:09:22,950
Nobody ever goes back to remove

340
00:09:22,950 --> 00:09:23,909
the permissions they stopped

341
00:09:23,909 --> 00:09:25,750
needing, so the pile grows month

342
00:09:25,750 --> 00:09:26,590
after month.

343
00:09:26,590 --> 00:09:28,309
Then one day it breaks in a
confusing way.

344
00:09:28,309 --> 00:09:30,190
Somewhere around one hundred and
forty permissions.

345
00:09:30,190 --> 00:09:32,590
The sign in can fail with an
error claiming the user

346
00:09:32,590 --> 00:09:35,750
cancelled the login when the
real cause is the pile itself.

347
00:09:35,750 --> 00:09:37,669
The message points at the
browser, and the problem is

348
00:09:37,669 --> 00:09:39,029
nowhere near the browser.

349
00:09:39,029 --> 00:09:41,350
That makes for a genuinely
baffling afternoon.

350
00:09:41,350 --> 00:09:43,669
The fix is to clean house before
you hit the wall.

351
00:09:43,669 --> 00:09:46,370
You can remove permissions you
no longer need, and it pays to

352
00:09:46,370 --> 00:09:49,190
treat that approved list like a
closet instead of a landfill.

353
00:09:49,190 --> 00:09:52,309
A short review a couple of times
a year keeps the sign in healthy

354
00:09:52,309 --> 00:09:53,870
and keeps your tenant honest.

355
00:09:53,870 --> 00:09:56,070
The second trap is the beta
version of the module.

356
00:09:56,070 --> 00:09:58,830
The SDK ships in two flavors,
where one talks to the stable

357
00:09:58,830 --> 00:10:01,149
servers and the other talks to a
preview service where features

358
00:10:01,149 --> 00:10:02,669
can change without warning.

359
00:10:02,669 --> 00:10:05,110
It's tempting to reach for the
shiny preview command to get a

360
00:10:05,110 --> 00:10:07,710
job done early, and that trade
rarely pays off.

361
00:10:07,710 --> 00:10:10,470
Preview features can break your
script on an ordinary Tuesday

362
00:10:10,470 --> 00:10:11,549
with no notice.

363
00:10:11,549 --> 00:10:12,789
Save them for experiments and

364
00:10:12,789 --> 00:10:14,039
keep real work on the stable

365
00:10:14,039 --> 00:10:14,759
side.

366
00:10:14,759 --> 00:10:17,600
The third trap is pagination,
and it fools almost everybody

367
00:10:17,600 --> 00:10:18,399
the first time.

368
00:10:18,399 --> 00:10:21,120
A list command does not hand you
everything at once, it hands you

369
00:10:21,120 --> 00:10:24,279
one page, often around one
hundred rows, and then it stops,

370
00:10:24,279 --> 00:10:27,039
which makes people think their
data has gone missing.

371
00:10:27,039 --> 00:10:28,639
A switch exists that follows the

372
00:10:28,639 --> 00:10:30,159
pages for you, and another

373
00:10:30,159 --> 00:10:31,600
setting controls how large each

374
00:10:31,600 --> 00:10:33,240
page is so you can balance speed

375
00:10:33,240 --> 00:10:34,320
against load.

376
00:10:34,320 --> 00:10:35,720
The fourth trap is throttling,

377
00:10:35,720 --> 00:10:36,960
which is the service protecting

378
00:10:36,960 --> 00:10:37,639
itself.

379
00:10:37,639 --> 00:10:40,720
If you hammer Microsoft Graph
with too many calls too quickly,

380
00:10:40,720 --> 00:10:43,360
it pushes back with an error
that basically says too many

381
00:10:43,360 --> 00:10:46,440
requests, plus a header telling
you how long to wait.

382
00:10:46,440 --> 00:10:49,399
Retrying instantly makes it
worse because every retry still

383
00:10:49,399 --> 00:10:50,879
counts against your limit.

384
00:10:50,879 --> 00:10:53,360
The good news is, the SDK
already knows how to wait and

385
00:10:53,360 --> 00:10:56,000
try again, so most of the time
you simply let it.

386
00:10:56,000 --> 00:10:59,120
There is a gentler version of
the same lesson for giant jobs.

387
00:10:59,120 --> 00:11:01,799
When you need to pull enormous
amounts of data out of Microsoft

388
00:11:01,799 --> 00:11:04,639
three hundred sixty five, a
separate bulk service exists for

389
00:11:04,639 --> 00:11:07,080
exactly that, and it isn't
subject to the same limits as

390
00:11:07,080 --> 00:11:08,200
the everyday commands.

391
00:11:08,200 --> 00:11:10,600
Most beginners will never need
it, but it's good to know the

392
00:11:10,600 --> 00:11:12,000
ceiling has a door in it.

393
00:11:12,000 --> 00:11:14,799
The last trap is asking for
every column when you need two.

394
00:11:14,799 --> 00:11:17,610
When you pull a large list, trim
the response down to the

395
00:11:17,610 --> 00:11:20,129
properties you actually use
because a smaller answer travels

396
00:11:20,129 --> 00:11:21,730
faster and reads more clearly.

397
00:11:21,730 --> 00:11:23,149
Small habits like that separate

398
00:11:23,149 --> 00:11:24,210
a script that works from a

399
00:11:24,210 --> 00:11:25,370
script that works at scale

400
00:11:25,370 --> 00:11:26,370
today.

401
00:11:26,370 --> 00:11:28,649
Why the old Azure ad modules are
gone for good?

402
00:11:28,649 --> 00:11:30,330
Let's go back to where we
started because now the

403
00:11:30,330 --> 00:11:31,289
retirement makes sense.

404
00:11:31,289 --> 00:11:34,029
Those old modules weren't
retired because Microsoft got

405
00:11:34,029 --> 00:11:34,690
bored of them.

406
00:11:34,690 --> 00:11:37,230
They were retired because the
whole platform consolidated onto

407
00:11:37,230 --> 00:11:40,649
Microsoft Graph, and the old
tools only reached part of it.

408
00:11:40,649 --> 00:11:42,370
The timeline is already history.

409
00:11:42,370 --> 00:11:43,649
Microsoft first named March of

410
00:11:43,649 --> 00:11:44,649
twenty twenty four as the

411
00:11:44,649 --> 00:11:46,210
retirement date, then pushed it

412
00:11:46,210 --> 00:11:47,529
back because the change was so

413
00:11:47,529 --> 00:11:48,250
large.

414
00:11:48,250 --> 00:11:51,009
Support actually ended on March
thirtieth, twenty twenty five.

415
00:11:51,009 --> 00:11:53,090
After that, the two modules left
one at a time.

416
00:11:53,090 --> 00:11:54,289
Miss online stopped working for

417
00:11:54,289 --> 00:11:55,450
all tenants by late May of

418
00:11:55,450 --> 00:11:57,250
twenty twenty five, and Azure AD

419
00:11:57,250 --> 00:11:58,529
PowerShell was retired shortly

420
00:11:58,529 --> 00:11:59,909
after July first, twenty twenty

421
00:11:59,909 --> 00:12:00,210
five.

422
00:12:00,210 --> 00:12:02,370
Tenants didn't get a personal
warning, so a lot of scripts

423
00:12:02,370 --> 00:12:03,730
just quietly stopped.

424
00:12:03,730 --> 00:12:05,450
The names changed along with the
tools.

425
00:12:05,450 --> 00:12:06,990
Anything that used to say Azure

426
00:12:06,990 --> 00:12:10,049
AD or Miss Online now says so

427
00:12:10,049 --> 00:12:11,909
get Azure ad user becomes get MG

428
00:12:11,909 --> 00:12:12,289
user.

429
00:12:12,289 --> 00:12:14,970
Microsoft publishes a map from
the old names to the new ones,

430
00:12:14,970 --> 00:12:17,379
and it's the quickest way to
translate a script you inherited

431
00:12:17,379 --> 00:12:18,620
from someone else.

432
00:12:18,620 --> 00:12:21,299
You might think this was a
cosmetic rename, and it wasn't.

433
00:12:21,299 --> 00:12:22,500
The rebuild runs on modern

434
00:12:22,500 --> 00:12:23,460
authentication, which is a

435
00:12:23,460 --> 00:12:24,659
security upgrade, and that's the

436
00:12:24,659 --> 00:12:25,700
real reason the shift happened

437
00:12:25,700 --> 00:12:26,220
at all.

438
00:12:26,220 --> 00:12:28,860
The old sign in patterns were
getting riskier, and the new

439
00:12:28,860 --> 00:12:31,220
foundation closes doors that had
been left open.

440
00:12:31,220 --> 00:12:32,779
One more thing is worth a
mention.

441
00:12:32,779 --> 00:12:35,700
A newer module called Microsoft
Entra PowerShell is built

442
00:12:35,700 --> 00:12:38,700
specifically for entry ID tasks,
and it's over ninety eight

443
00:12:38,700 --> 00:12:41,259
percent compatible with the old
Azure AD commands.

444
00:12:41,259 --> 00:12:44,139
It even ships with a switch that
lets many old scripts run almost

445
00:12:44,139 --> 00:12:46,620
unchanged, which can be the
gentler road if you're staring

446
00:12:46,620 --> 00:12:48,460
at a pile of legacy work.

447
00:12:48,460 --> 00:12:51,259
The practical takeaway is simple
if you maintain a script that

448
00:12:51,259 --> 00:12:53,820
still calls the old modules,
it's already living on borrowed

449
00:12:53,820 --> 00:12:56,860
time, and the sooner it moves to
the new names, the less painful

450
00:12:56,860 --> 00:12:58,139
the move will be.

451
00:12:58,139 --> 00:13:00,860
The map makes the translation
mechanical for most commands,

452
00:13:00,860 --> 00:13:04,100
and the awkward ones are better
rewritten by hand anyway.

453
00:13:04,100 --> 00:13:07,500
Where this fits next to Azure,
the Portal and Graph Explorer.

454
00:13:07,500 --> 00:13:09,820
Let's zoom out for a moment and
see the bigger picture.

455
00:13:09,820 --> 00:13:11,100
The same graph interface you're

456
00:13:11,100 --> 00:13:12,059
learning is what a lot of

457
00:13:12,059 --> 00:13:13,539
Microsoft's own tools use

458
00:13:13,539 --> 00:13:13,940
underneath.

459
00:13:13,940 --> 00:13:16,379
So this isn't a side skill you
pick up and forget.

460
00:13:16,379 --> 00:13:18,580
It's closer to the shared
language of the platform.

461
00:13:18,580 --> 00:13:21,539
On the Azure side, these scripts
live comfortably in services

462
00:13:21,539 --> 00:13:24,539
like Azure Automation or an
Azure function, where a managed

463
00:13:24,539 --> 00:13:25,659
identity handles the sign.

464
00:13:25,659 --> 00:13:27,620
In that identity is an account

465
00:13:27,620 --> 00:13:29,139
Azure creates and looks after

466
00:13:29,139 --> 00:13:29,460
for you.

467
00:13:29,460 --> 00:13:30,899
So there's no stored password,

468
00:13:30,899 --> 00:13:32,600
nothing to rotate, and nothing

469
00:13:32,600 --> 00:13:33,139
to leak.

470
00:13:33,139 --> 00:13:35,820
That's the grown up way to run
automation, and it comes within

471
00:13:35,820 --> 00:13:37,139
reach sooner than you'd think.

472
00:13:37,139 --> 00:13:40,659
If you prefer to learn by poking
around Open Graph Explorer, it's

473
00:13:40,659 --> 00:13:42,820
a free browser tool where you
type a request and watch the

474
00:13:42,820 --> 00:13:45,419
exact call happen, and it's a
safe place to break things.

475
00:13:45,419 --> 00:13:46,700
Before you ever point a script

476
00:13:46,700 --> 00:13:48,460
at real Users, you can copy what

477
00:13:48,460 --> 00:13:49,539
works and take it back into

478
00:13:49,539 --> 00:13:50,259
PowerShell.

479
00:13:50,259 --> 00:13:53,100
There's also the raw interface
sitting under the SDK, and it

480
00:13:53,100 --> 00:13:54,659
helps to know it exists.

481
00:13:54,659 --> 00:13:57,460
It's the same service with more
manual work because you assemble

482
00:13:57,460 --> 00:14:00,779
the request yourself, the SDK
hands you named commands and

483
00:14:00,779 --> 00:14:02,059
tidy objects instead.

484
00:14:02,059 --> 00:14:04,820
And for a beginner, that
difference is the whole reason

485
00:14:04,820 --> 00:14:05,500
to start here.

486
00:14:05,500 --> 00:14:06,580
The choice between clicking and

487
00:14:06,580 --> 00:14:07,679
scripting comes down to

488
00:14:07,679 --> 00:14:08,940
repetition.

489
00:14:08,940 --> 00:14:11,620
For a one off change, click
because it's faster and there's

490
00:14:11,620 --> 00:14:13,139
no reason to write anything.

491
00:14:13,139 --> 00:14:15,019
The moment a task repeats or

492
00:14:15,019 --> 00:14:16,700
scales past a handful of people,

493
00:14:16,700 --> 00:14:18,019
that's the line where a script

494
00:14:18,019 --> 00:14:18,700
wins.

495
00:14:18,700 --> 00:14:22,110
It helps to see the SDK as one
way into a much larger space.

496
00:14:22,110 --> 00:14:23,429
The portal is another way in.

497
00:14:23,429 --> 00:14:26,389
Graph explorer is a place to
practice, and the raw interface

498
00:14:26,389 --> 00:14:28,470
is the same thing with the
friendly handles removed.

499
00:14:28,470 --> 00:14:30,809
You don't have to pick one
forever, and most people move

500
00:14:30,809 --> 00:14:34,309
between them depending on the
job in front of them, what to

501
00:14:34,309 --> 00:14:35,669
remember and where to go next.

502
00:14:35,669 --> 00:14:37,230
Let me pull the thread together.

503
00:14:37,230 --> 00:14:39,789
The Microsoft Graph PowerShell
SDK is a set of commands that

504
00:14:39,789 --> 00:14:42,230
talk to Microsoft three hundred
sixty five and Azure through

505
00:14:42,230 --> 00:14:44,870
Microsoft Graph, and it replaced
the older modules that were

506
00:14:44,870 --> 00:14:46,669
retired in twenty twenty five.

507
00:14:46,669 --> 00:14:47,629
You sign in once.

508
00:14:47,629 --> 00:14:48,909
You ask for only the permissions

509
00:14:48,909 --> 00:14:50,470
you need, and you use ordinary

510
00:14:50,470 --> 00:14:52,250
verbs you already recognize the

511
00:14:52,250 --> 00:14:53,389
bumps to remember are the

512
00:14:53,389 --> 00:14:54,509
permissions pile.

513
00:14:54,509 --> 00:14:55,870
The temptation of preview

514
00:14:55,870 --> 00:14:57,529
features, the pagination that

515
00:14:57,529 --> 00:14:58,870
hides your data, and the

516
00:14:58,870 --> 00:14:59,990
throttling that punishes

517
00:14:59,990 --> 00:15:01,029
impatience.

518
00:15:01,029 --> 00:15:03,470
Keep those four in mind, and
you'll avoid most of the pain

519
00:15:03,470 --> 00:15:04,909
that new users run into.

520
00:15:04,909 --> 00:15:06,669
So here's the question I'll
leave you with.

521
00:15:06,669 --> 00:15:07,950
If you could hand one repetitive

522
00:15:07,950 --> 00:15:08,990
Microsoft three hundred sixty

523
00:15:08,990 --> 00:15:10,429
five task to a script tomorrow,

524
00:15:10,429 --> 00:15:11,669
which task would it be and

525
00:15:11,669 --> 00:15:12,710
what's actually stopping you

526
00:15:12,710 --> 00:15:14,350
from trying it this week if this

527
00:15:14,350 --> 00:15:15,309
made the topic feel less

528
00:15:15,309 --> 00:15:15,990
intimidating?

529
00:15:15,990 --> 00:15:19,830
Subscribe to M365 FM to master
the tools and the mindset

530
00:15:19,830 --> 00:15:21,429
shaping the future of work.