Entra ID User Lifecycle with PowerShell 7: Onboarding, Offboarding and More

I have worked in IT for about 20 years. A lot of that was MSP operations. Today I work as an M365 cloud admin.

I kept writing the same scripts. So I cleaned them up and shared them on GitHub. This toolkit covers day-to-day Microsoft Entra ID work with PowerShell 7 and the Microsoft.Graph SDK v2.

Repo: entra-id-powershell-toolkit

The problem it solves

Joiners and leavers never stop. Doing them by hand is slow. It is also easy to miss a step.

App secrets are another quiet risk. They expire, and an app breaks on a Monday morning.

These scripts turn those jobs into repeatable steps you can test with -WhatIf first.

Highlight scripts

New-EntraUserFromCsv.ps1

Onboards users from a CSV. It creates the account, adds groups, and can issue a Temporary Access Pass. New users can then set up passwordless sign-in.

./New-EntraUserFromCsv.ps1 -CsvPath ./samples/new-users.sample.csv -WhatIf
./New-EntraUserFromCsv.ps1 -CsvPath ./samples/new-users.sample.csv -IssueTemporaryAccessPass

Invoke-EntraUserOffboarding.ps1

Blocks sign-in, revokes sessions and removes group memberships. Add -RemoveLicenses to free the licenses too.

./Invoke-EntraUserOffboarding.ps1 -UserPrincipalName former.user@contoso.com -WhatIf

Get-AppCredentialExpiryReport.ps1

Lists client secrets and certificates on app registrations that are expired or expire soon.

./Get-AppCredentialExpiryReport.ps1 -DaysAhead 60

Other scripts cover dynamic groups, bulk group members, group reports, license assignment, sign-in log analysis and a PIM role report.

How the scripts are built

• PowerShell 7.4 or later.
• Comment-based help on every script. Run Get-Help ./script.ps1 -Full.
• Reports export to CSV.
• Change scripts support -WhatIf and -Confirm.
• Certificate (app-only) or interactive sign-in.
• No secrets in the repo. Examples use contoso.com and placeholder GUIDs.

Please test in a dev or test tenant first. Read each script before you run it.

My usual workflow

I start with the reports. They are read-only and safe. I open the CSV in Excel and look for anything odd.

Then I pick one fix. I run the change script with -WhatIf and read the output. If it looks right, I run it again for real.

For jobs I repeat, I use a certificate and schedule the script. That way nobody has to remember to run it.

Getting started

Clone the repo:

git clone https://github.com/anthonybuhnerkemper/entra-id-powershell-toolkit.git
cd entra-id-powershell-toolkit

Every toolkit ships the same Connect-M365Admin script. Dot-source it, then connect.

# Interactive sign-in
. ./scripts/Connect/Connect-M365Admin.ps1
Connect-M365Admin -Service Graph -Interactive -ClientId 00000000-0000-0000-0000-000000000000

# Or app-only with a certificate
$env:M365_TENANT_ID       = '00000000-0000-0000-0000-000000000000'
$env:M365_CLIENT_ID       = '00000000-0000-0000-0000-000000000000'
$env:M365_CERT_THUMBPRINT = '0000000000000000000000000000000000000000'
Connect-M365Admin -Service Graph

Run a report, check the CSV, then call Disconnect-M365Admin when you are done. The README lists the modules and roles each script needs.

More toolkits

I have nine more free toolkits that use the same pattern: graph-powershell7-admin-toolkit, exchange-online-powershell-toolkit, sharepoint-online-powershell-toolkit, onedrive-powershell-toolkit, teams-powershell-toolkit, intune-powershell-toolkit, defender-xdr-powershell-toolkit, sentinel-kql-toolkit, purview-compliance-toolkit.

You can find them all on my GitHub profile.

Feedback welcome

Issues, ideas and pull requests are welcome. What would you add? Tell me in the comments.