Support for both Azure AD and MSOL modules have been extended to allow the updating of scripts and I would presume due to some command not existing in Graph yet. The modules will be deprecated in June 30th 2023 so any scripts using command with either of these modules should be updated as soon as possible.
In this post we will be going through some common commands that use either the Azure AD or MSOL PowerShell modules and how to find commands that will replace them in Graph and using the scope roles to set required API permissions.
First stop I usually do is to check if the commands have direct replacements, we can use the below learn page to check. The page will have tables with the Azure AD / MSOL command and then the replacement command if one exist in the second row.
For the below reference we will be using Get-MsolUser if we check the document that command is replaced by Get-MgUser.
Now when connecting to Azure AD or MSOL all commands and permission are based on the role of the account you sign-in with.
If we connect with MSOL we can query users once we have the required role.
For Graph the way to connect is slightly different if we don’t specify a scope when connecting, we can connect but we don’t automatically have the require API permission assigned so if we run the Get-MgUser command we will get an error for insufficient privilege’s
If we add the -scope User.Read.All
If we want to check what permission are available for a command we can use Find-MgGraphCommand with the command we want to check. We can also use the apiversioni (v1.0 or beta)
Find-MgGraphCommand -Command Get-MgUser -ApiVersion v1.0 |fl
To just return the permission we can use parenthesis to select just the permissions.
(Find-MgGraphCommand -Command Get-MgUser -ApiVersion v1.0).Permissions
Depending on what task we are trying to do we can select the required permission, one example is if I just want to get back information on account’s I would just use User.Read.All. If I wanted to change a users settings I would use the User.ReadWirte.All.
Another difference between modules is that in Graph there is no -userprinicpalname parameter and uses UserID instead
To get licenses assigned to a user we can use.
Get-MgUserLicenseDetail -UserId UPN
As we can see Microsoft Graph has a few differences and instead of having most data under single objects like Get-MsolUser we have to now use multiple commands to return the same data which can be a bit more difficult when starting out.
TheSleepyAdmins 