Tracking Critical App Actions Through Audit Events
App management audit events are captured when changes are made to Entra registered and enterprise apps. Critical app management audit events should be closely monitored to ensure that permissions are used properly and attackers haven't attempted to penetrate the tenant to extract data. This article explains how to find and analyze audit data for some critical app management audit events and run the code as an Azure Automation runbook. https://practical365.com/app-management-audit-events/Practical Graph: Assigning Sensitivity Labels to SharePoint Files with the PowerShell SDK
A new Set-MgDriveItemSensitivityLabel cmdlet makes it easier to assign sensitivity labels in PowerShell scripts. However, the cmdlet does not get around the restriction imposed by Microsoft on using metered APIs. Apps still must be registered as Azure resources before scripts can run the cmdlet. It's easy to understand why, even if it seems strange at first. https://practical365.com/assign-sensitivity-labels-cmdlet/Automating Microsoft 365 with PowerShell Second Edition
The Office 365 for IT Pros team are thrilled to announce the availability of Automating Microsoft 365 with PowerShell (2nd edition). This completely revised 350-page book delivers the most comprehensive coverage of how to use Microsoft Graph APIs and the Microsoft Graph PowerShell SDK with Microsoft 365 workloads (Entra ID, Exchange Online, SharePoint Online, Teams, Planner, and more). Existing subscribers can download the second edition now free of charge. https://office365itpros.com/2025/06/30/automating-microsoft-365-with-powershell2/Token Protection Extends to Microsoft Graph PowerShell SDK Sessions
The conditional access policy condition for token protection now extends to Microsoft Graph PowerShell SDK interactive sessions. Any account within the scope of a CA policy that requires token protection can use Web Account Manager (WAM) to sign in and check that everything is secure and ready to go. It’s a protection that might be of interest to administrators and developers that access sensitive data in Graph SDK sessions. https://office365itpros.com/2025/06/26/token-protection-graph-sdk/Updating the Entra ID Custom Banned Password List with PowerShell
Microsoft 365 tenants with Entra P1 or P2 licenses can use a custom banned password list to stop people using specific terms in their passwords. The idea is to prevent easily-guessed terms being used in passwords. You could also block words deemed to be objectionable. In any case, this article explains how to maintain the custom blocked password list with a PowerShell script. https://office365itpros.com/2025/06/19/custom-banned-password-list/When the Invoke-MgGraphRequest Cmdlet Needs Help to Fetch Responses
Sometimes it’s hard to get a response back from running a Graph API request with the Invoke-MgGraphRequest cmdlet. Graph Explorer helps. So does reading Microsoft’s documentation for the cmdlet. In the end, everything works out and we can discover some valuable information that comes back in a response header. In this case, the response header helps us discover if a purge job works. All of this might sound quirky, but it could make a difference to your PowerShell scripts. https://office365itpros.com/2025/06/12/invoke-mggraphrequest-responses/
GRAPH API error: Create Upload Session: HTTP result - 409 Conflict
Has anyone encounter issues when using Instance Attributes? Particularly the property microsoft.graph.conflictBehavior with "replace" when there's a conflict? In my case, I use SAS Studio to send files from Linux to SharePoint. A SAS macro with Graph API was used to upload from Linux to SharePoint. The Graph API did not follow the provided ConflictBehavior to "replace" the existing file. It was working as of June 2nd, 2025, USA time. Not anymore on June 3rd, 2025. None of my process or files was changed. Does anyone have any insight? Thank you, JerryAvoid The Five Big Errors in Graph PowerShell Scripts
Everyone learns from experience. This article covers five important building blocks for writing great Graph PowerShell scripts, the product of hard-won experience and many mistakes. Filtering, properties, permissions, and pagination all make the list. https://practical365.com/graph-powershell-5-tips/Mailbox Import-Export Graph APIs Leave No Audit Trail
A recent post revealed that the Mailbox Import-Export Graph API doesn’t capture audit events for its operations. The API is in beta, but this is disappointing. Auditing any mailbox is important, but it becomes a critical requirement when the possibility exists that attackers could use the API to exfiltrate mailbox data outside of the tenant. This is a hole that Microsoft needs to close. https://office365itpros.com/2025/06/04/import-export-graph-api/Power Automate Flow moving Attachments in Email to MS List - can it get a Email as an attachment?
Created a Flow to get Emails from Outlook using Graph API to extract all metadata into columns in a MS List including attachments of the Email into a column in the MS List with the name as a hyperlink in the same site as the list; but when there is another Email as an attachment it does not come into the MS List. Is there such a limitation in MS Flow where it cannot get the Email attached in an Email as an Attachment?
