Primer: How to Use RBAC for Applications to Control App Use of the Mail.Send Permission
The temptation to use the Mail.Send application permission in scripts can lead PowerShell developers into trouble because the permission allows access to all mailboxes, including sensitive executive and financial mailboxes. Fortunately, RBAC for Applications allows tenants to control the access that apps have to mailboxes and other Exchange content. All explained here with an example script to test RBAC of Applications. https://office365itpros.com/2026/02/17/mail-send-rbac-for-applications/
Now Easily Audit Email Deletion in Office 365
I have created a PowerShell script to find out who deleted an email from the Office 365 mailbox. By using in-built filtering params, you can generate 7 granular email deletion audit reports. https://o365reports.com/2021/09/02/audit-email-deletion-in-office-365-mailbox-powershell/ I have listed a few use-cases of the script below, - Tracks all the deleted emails - Identifies who deleted emails from a shared mailbox - Audits deleted emails from a specific mailbox - Finds deleted emails by subject - Audits email deletion for custom period - Schedules audit report to track email deletionI built a free, open-source M365 security assessment tool - looking for feedback
I work as an IT consultant, and a good chunk of my time is spent assessing Microsoft 365 environments for small and mid-sized businesses. Every engagement started the same way: connect to five different PowerShell modules, run dozens of commands across Entra ID, Exchange Online, Defender, SharePoint, and Teams, manually compare each setting against CIS benchmarks, then spend hours assembling everything into a report the client could actually read. The tools that automate this either cost thousands per year, require standing up Azure infrastructure just to run, or only cover one service area. I wanted something simpler: one command that connects, assesses, and produces a client-ready deliverable. So I built it. What M365 Assess does https://github.com/Daren9m/M365-Assess is a PowerShell-based security assessment tool that runs against a Microsoft 365 tenant and produces a comprehensive set of reports. Here is what you get from a single run: 57 automated security checks aligned to the CIS Microsoft 365 Foundations Benchmark v6.0.1, covering Entra ID, Exchange Online, Defender for Office 365, SharePoint Online, and Teams 12 compliance frameworks mapped simultaneously -- every finding is cross-referenced against NIST 800-53, NIST CSF 2.0, ISO 27001:2022, SOC 2, HIPAA, PCI DSS v4.0.1, CMMC 2.0, CISA SCuBA, and DISA STIG (plus CIS profiles for E3 L1/L2 and E5 L1/L2) 20+ CSV exports covering users, mailboxes, MFA status, admin roles, conditional access policies, mail flow rules, device compliance, and more A self-contained HTML report with an executive summary, severity badges, sortable tables, and a compliance overview dashboard -- no external dependencies, fully base64-encoded, just open it in any browser or email it directly The entire assessment is read-only. It never modifies tenant settings. Only Get-* cmdlets are used. A few things I'm proud of Real-time progress in the console. As the assessment runs, you see each check complete with live status indicators and timing. No staring at a blank terminal wondering if it hung. The HTML report is a single file. Logos, backgrounds, fonts -- everything is embedded. You can email the report as an attachment and it renders perfectly. It supports dark mode (auto-detects system preference), and all tables are sortable by clicking column headers. Compliance framework mapping. This was the feature that took the most work. The compliance overview shows coverage percentages across all 12 frameworks, with drill-down to individual controls. Each finding links back to its CIS control ID and maps to every applicable framework control. Pass/Fail detail tables. Each security check shows the CIS control reference, what was checked, what the expected value is, what the actual value is, and a clear Pass/Fail/Warning status. Findings include remediation descriptions to help prioritize fixes. Quick start If you want to try it out, it takes about 5 minutes to get running: # Install prerequisites (if you don't have them already) Install-Module Microsoft.Graph, ExchangeOnlineManagement -Scope CurrentUser Clone and run git clone https://github.com/Daren9m/M365-Assess.git cd M365-Assess .\Invoke-M365Assessment.ps1 The interactive wizard walks you through selecting assessment sections, entering your tenant ID, and choosing an authentication method (interactive browser login, certificate-based, or pre-existing connections). Results land in a timestamped folder with all CSVs and the HTML report. Requires PowerShell 7.x and runs on Windows (macOS and Linux are experimental -- I would love help testing those platforms). Cloud support M365 Assess works with: Commercial (global) tenants GCC, GCC High, and DoD environments If you work in government cloud, the tool handles the different endpoint URIs automatically. What is next This is actively maintained and I have a roadmap of improvements: More automated checks -- 140 CIS v6.0.1 controls are tracked in the registry, with 57 automated today. Expanding coverage is the top priority. Remediation commands -- PowerShell snippets and portal steps for each finding, so you can fix issues directly from the report. XLSX compliance matrix -- A spreadsheet export for audit teams who need to work in Excel. Standalone report regeneration -- Re-run the report from existing CSV data without re-assessing the tenant. I would love your feedback I have been building this for my own consulting work, but I think it could be useful to the broader community. If you try it, I would genuinely appreciate hearing: What checks should I prioritize next? Which security controls matter most in your environment? What compliance frameworks are most requested by your clients or auditors? How does the report land with non-technical stakeholders? Is the executive summary useful, or does it need work? macOS/Linux users -- does it run? What breaks? I have tested it on macOS, but not extensively. Bug reports, feature requests, and contributions are all welcome on GitHub. Repository: https://github.com/Daren9m/M365-Assess License: MIT (free for commercial and personal use) Runtime: PowerShell 7.x Thanks for reading. Happy to answer any questions in the comments.Removing Inactive Entra ID User Accounts with PowerShell
The Entra ID Governance solution includes a workflow to detect and remove inactive user accounts. Sounds good, but the same can be done with PowerShell if you want to avoid the cost of Entra ID Governance licenses or want to create a bespoke workflow that’s better suited to the business needs of the organization. Azure Automation would be a good way to process this workflow. https://office365itpros.com/2025/11/17/remove-inactive-user-accounts/Automating Microsoft 365 with PowerShell Second Edition
The Office 365 for IT Pros team are thrilled to announce the availability of Automating Microsoft 365 with PowerShell (2nd edition). This completely revised 350-page book delivers the most comprehensive coverage of how to use Microsoft Graph APIs and the Microsoft Graph PowerShell SDK with Microsoft 365 workloads (Entra ID, Exchange Online, SharePoint Online, Teams, Planner, and more). Existing subscribers can download the second edition now free of charge. https://office365itpros.com/2025/06/30/automating-microsoft-365-with-powershell2/Practical Purview: Removing Old Items from User Calendars
A reader wants to remove all calendar items over a certain age. Compliance purge actions seem like a good way to do this, but there's a problem that needs to be fixed. eDiscovery purges can do the job, but only if you have eDiscovery Premium. And then there's Graph APIs to consider. All in all, many ways exist to purge calendar items. https://practical365.com/ediscovery-purges/Creating Viva Engage Communities with the Graph API
A new beta Graph API supports the creation of a Viva Engage community. This article explains how to use the Graph SDK to create a new community with the API. It’s the start on the transition from the old Yammer APIs to fully embrace the Graph API. https://office365itpros.com/2024/01/03/viva-engage-community-graph/Export Office 365 Mailbox Calendar Permissions using PowerShell
Delegating calendar access is one of the popular Exchange features. As an admin, managing calendar permission is one of the challenging tasks because, Microsoft has not provided GUI based report to view calendars sharing settings. PowerShell needs multiple cmdlets to retrieve calendar permissions. So, I have created a PowerShell script that can generate 6 different calendar permission reports based on the requirement. https://o365reports.com/2021/11/02/get-calendar-permissions-report-for-office365-mailboxes-powershell I have listed a few significant use cases of the script below, Get calendar permissions for all users Get calendars shared with external users List all calendars a user has access to View all calendars’ sharing permissions (including default and anonymous sharing) Export calendar permissions for list of mailboxes – input CSV Get default calendar permission Schedule calendar permission reportAll Emails purged after running Compliance command except those in "top of information store" Folder
Hello Tech Folks, We have received a request to delete some items(Email Messages] from EXCHANGE. According to this guide, https://docs.microsoft.com/en-us/microsoft-365/compliance/search-for-and-delete-messages-in-your-organization?view=o365-worldwide I created my content search and ran it [ STEP1] Then as STEP2: I connected to Compliance & Security Center in PowerShell as Admin, and ran New-ComplianceSearchAction -SearchName "ABC_004_22_2" -Purge -PurgeType SoftDelete [ I ran this command atleast 10 times ] Once I get the status via: Get-ComplianceSearchAction -Identity 'ABC_004_22_2_Purge' | Format-list It shows the task has been completed... Name SearchName Action RunBy JobEndTime Status ---- ---------- ------ ----- ---------- ------ ABC_004_22_2_Purge ABC_004_22_2 Purge Fadavinia, Ali 2021/05/18 9:26:29 PM Completed Now my question is here: I exported the results - all items deleted but not a few items residing in "top of information store" folder. How can I get those items deleted in that folder aswell? Should I be worry about items sitting there? Trying to understand why those few remaining items aren't being purged?! Thanks for your input Ali
