A collection of PowerShell scripts automating common sysadmin tasks against a live Microsoft Entra ID / Intune tenant via the Microsoft Graph PowerShell SDK. Built to demonstrate that infrastructure and identity management can scale past manual, click-through administration, especially relevant for organizations supporting multiple offices and remote staff, where repetitive tasks (new hire setup, account audits, device health checks) don't scale as a one-by-one console process.
Each script solves a specific, realistic problem a sysadmin would own on a recurring basis, not a one-off demo.
- Provision new user accounts in bulk from a CSV input, rather than manual console entry per hire
- Audit user accounts for inactivity or accounts that were created but never activated
- Report on Intune-managed device compliance across a fleet, flagging problems automatically
- Authenticate securely to Microsoft Graph using delegated, scoped permissions
- Handle real-world failure modes gracefully (missing license, no data, bad input) rather than crashing
- Authentication: Microsoft Graph PowerShell SDK, delegated access via device code flow
- Tenant: Microsoft Entra ID / Intune Plan 1 trial tenant
- PowerShell: Windows PowerShell 5.1
- Modules used:
Microsoft.Graph.Authentication,Microsoft.Graph.Users,Microsoft.Graph.DeviceManagement
Reads a CSV of new hires (name, department, office, job title) and creates a Microsoft Entra ID account for each, with a randomly generated temporary password requiring change at next sign-in. Logs the outcome of every attempt, success or failure, to a timestamped CSV.
Tested against: 3 sample new-hire records across three different offices (Orlando, Miami, Remote). All three accounts created successfully.
Security note: This script displays temporary passwords in console output and the exported log for lab demonstration purposes only. In a production environment, temporary passwords should be delivered through a secure out-of-band channel (encrypted email, self-service portal), not written to a log file.
Queries all users in the tenant and flags accounts that haven't signed in within a configurable threshold (default 30 days), including accounts that have never signed in at all, a distinct and often-overlooked category from "inactive."
Tested against: The three freshly provisioned accounts from Script 1, correctly flagged as "Never Signed In" since they hadn't yet been used, a realistic and useful result, not just a happy-path pass.
Pulls compliance status for every Intune-managed device in the tenant and produces a summary report, with a clear warning block for any noncompliant devices. Handles licensing/authorization failures gracefully with an explanatory message instead of a raw stack trace.
Tested against: A live enrolled device that returned a genuine noncompliant status, the script correctly surfaced this in its warning output rather than silently reporting success.
Each script exports a timestamped CSV alongside console output. This mirrors how these scripts would actually be used day-to-day: something to hand off, email, or attach to a ticket, not just a screen that disappears when the terminal closes.
- Microsoft Graph PowerShell SDK authentication and scoped permission requests
- Bulk identity provisioning from structured input data
- Account lifecycle auditing (inactivity, unused accounts)
- Cross-referencing device management data (Intune) with PowerShell automation
- Defensive scripting: connection checks, try/catch error handling, graceful failure messaging
- Real-world debugging: parameter typos, OData query syntax, module dependency conflicts, licensing-vs-permissions distinctions
scripts/New-BulkUserProvisioning.ps1scripts/Get-InactiveAccountsReport.ps1scripts/Get-DeviceComplianceSummary.ps1sample-data/new-hires-template.csv— input format expected by Script 1troubleshooting-log.md— real issues hit during development and how they were resolvedscreenshots/— supporting evidence of each script running against a live tenant
Organizations managing growth across multiple offices and remote staff can't rely on manual, one-at-a-time administration for onboarding, account hygiene, or device compliance checks, it doesn't scale, and it's where things quietly fall through the cracks. These scripts represent the kind of automation that turns a recurring manual task into a repeatable, auditable process.