How to connect to Microsoft 365 with Microsoft Graph PowerShell

If you want to manage your Microsoft 365 organization with Microsoft Graph PowerShell, this article is for you.

Whether you’re just starting your PowerShell journey or have been using various PowerShell modules to manage your Microsoft 365 users for years, the time has come to learn something new. With the deprecation of the Azure AD and MSOnline modules, Microsoft Graph PowerShell is now the recommended way to handle your Microsoft 365 users at scale. Let’s see how you can use Microsoft Graph to access your organization’s data and manage it the admin way.

Before you start

If Microsoft Graph still feels like uncharted territory to you, here are some key facts to help you navigate it.

What is Microsoft Graph

Microsoft Graph is a platform that connects and organizes diverse Microsoft 365 data, allowing you to manage it in an automated way. Previously, you had to use separate solutions to manage data across different areas, such as email, document libraries, or user accounts. Microsoft Graph combines these capabilities into a unified solution, allowing you to handle everything from one place.

The number of admin tasks you can optimize with Microsoft Graph is vast. For example, it lets you:

• create, manage, or delete user accounts in Microsoft Entra ID,
• manage user permissions,
• automate company communications,
• access files and data stored in OneDrive or SharePoint, or
• generate analytics and reports.

Of course, as an admin, you can do all that using the GUI-based admin portals in Microsoft 365. But the real power of Microsoft Graph lies in its ability to manage large data sets in bulk across different areas of your environment and automate multiple tasks through scripts. For instance, if you need to onboard a group of new users, connecting to Graph allows you to create all the accounts and assign appropriate permissions using a single script, saving you a lot of time and effort.

What is Microsoft Graph API

Microsoft Graph API is the interface that allows you to use Graph’s capabilities and resources for various purposes. You interact with Graph by sending Graph API requests – such as GET, POST, or DELETE – or calling Graph API with PowerShell (which is probably why you’re here). Both these methods allow you to access specific Microsoft 365 data and perform necessary actions on it.

Graph API is a practical example of how Microsoft Graph aims to bring together previously separate solutions. Before Graph entered the scene, separate APIs were needed to handle different types of data – you would use EWS for email, SharePoint API for document libraries, and so on. Now, Graph API combines these separate interfaces within a single API.

While Graph API is a step towards simplifying admin work, be aware that it’s steadily replacing many of the older APIs that you might be used to. Some of them have already been deprecated (such as Outlook REST API), while others are currently being phased out (like EWS in Exchange Online, which is set to retire in October 2026). As a heads-up, Microsoft recommends using Graph wherever possible as its primary API for Microsoft 365 data.

At the same time, Graph is not a full replacement for every older API. Feature coverage isn’t always one-to-one, as some functions are still missing and some capabilities may never be added.

What is Microsoft Graph Explorer

Luckily for those who are still new to the Graph universe, Microsoft provides a useful developer tool for testing API requests on sample tenants and exploring what’s possible. The tool is called Microsoft Graph Explorer, and you can access it here.

If you want to test Graph API requests on your own Microsoft 365 tenant, Graph Explorer allows you to sign in with your account. Signing in gives you access to more advanced capabilities than using the tool anonymously. Just make sure you’re not using your production tenant – even though Graph Explorer is a testing tool, requests executed there can still affect your data!

How to use Microsoft Graph PowerShell to manage Microsoft 365

Now, let’s roll up our sleeves and see how you can put Microsoft Graph API to work with some good old PowerShell scripting rather than manual API requests.

1. Install the Microsoft.Graph module

The first thing you need to do is launch your PowerShell console (I like the ISE version) and install the Microsoft.Graph module using the following cmdlet:

Install-Module Microsoft.Graph -Scope CurrentUser

You’ll most likely run into a warning that you’re trying to install something from an untrusted repository, even though the module comes from an official Microsoft source. It’s your choice whether to trust it or not. Installing the module is a required step to use PowerShell, though.

Now, with PowerShell modules like ExchangeOnlineManagement, you’d simply use the Import-Module cmdlet to import the whole module in one go. It’s not as simple with Graph – running the Import-Module Microsoft.Graph cmdlet returns an error stating that “Function Get-MgUser cannot be created because function capacity 4096 has been exceeded for this scope”. This is because the full Graph module includes a very large number of cmdlets and cannot be imported as a whole.

That’s why you need to import only the specific submodules you need. For example, for managing Microsoft 365 users, you can run:

Import-Module Microsoft.Graph.Users

To get a full list of available Graph submodules, run the following cmdlet:

Get-Module Microsoft.Graph* -ListAvailable

2. Connect to your Microsoft 365 tenant

Now you can finally connect to the Microsoft 365 tenant you want to manage. Theoretically, you can do that using the Connect-MgGraph cmdlet, but it will only give you limited access to your resources. This is because, in delegated sign-in scenarios, Microsoft Graph requires you to specify permission scopes you’ll need during your session.

Security-wise, it’s a great change compared to older modules like Azure AD, as it prevents admins from doing more than they intended to (by mistake, presumably). It does complicate things a bit, though, because you must know which permissions you’ll need even before you start playing around in the console.

So, to actually connect to your Microsoft 365 tenant with the required permissions, check the name of the appropriate permission scope on this list and use it with the following cmdlet:

Connect-MgGraph -Scopes "scope_name"

For example, if you only need to retrieve some information about your M365 users and groups, you can use the following cmdlet:

Connect-MgGraph -Scopes "User.Read.All","Group.Read.All"

If you need to update some user or group data, you’ll use the following:

Connect-MgGraph -Scopes "User.ReadWrite.All","Group.ReadWrite.All"

It’s straightforward enough, right? The problem is when you get more complicated tasks that require access to some other parts of your tenant. Right now, there are 1050 distinct permission scopes on the list. You probably won’t use them all during your PowerShell journey, but personally, I find this number quite impressive.

3. Running scripts

Once you’ve connected to your Microsoft 365 organization, you can use all Microsoft Graph PowerShell cmdlets or complex scripts to call Graph API. Remember that at this point, you’re perfectly capable of managing your organization, hundreds of users at a time, and that means there’s a good chance that something will go wrong. Make sure you know what you’re doing and you fully understand the code you’re running before using it in production environments. Whenever possible, test scripts in a demo environment before applying your code in a proper tenant.

Want to use an AI tool to generate a script for you? Go ahead but, again, make sure to always verify what the script is going to do. PowerShell can be quite destructive and fixing the consequences of a faulty script will usually take much longer than writing a couple of lines of code yourself. And you can always refer to Microsoft Graph PowerShell documentation to learn your cmdlets.

Troubleshooting the connection

If you’ve already seen an error while trying to connect to Exchange Online with Microsoft Graph, there are quite a few possible reasons for that. Let’s quickly review some of them before we wrap up.

You don’t have the required permissions

Make sure the account you’re signing in with has the required permissions. If not, request the required permissions from an authorized user in your organization.

Execution policy

One of the oldest problems in the book is having your Execution Policy set to Restricted. Run Get-ExecutionPolicy to find out your policy settings. If it returns Restricted, run:

Set-ExecutionPolicy RemoteSigned

Microsoft Entra Conditional Access

If you experience issues related to your authentication method, device compliance, or policy configuration when connecting to your Microsoft 365 tenant, check the Conditional Access settings in the Microsoft Entra admin center – these settings are often the root cause of such issues. Learn more about Conditional Access