Application consents:
- user education
- every consent should be HIGHLY SCRUTINIZED. Every one. Especially from multitenant apps.
- restrict non-admin users from consenting to 3rd party apps, even verified publishers
/1
- user education
- every consent should be HIGHLY SCRUTINIZED. Every one. Especially from multitenant apps.
- restrict non-admin users from consenting to 3rd party apps, even verified publishers
/1
MSIdentityTools/src/Export-MsIdAppConsentGrantReport.ps1 at main · AzureAD/MSIdentityTools
Repository for the Microsoft Identity Tools PowerShell module which provides various tools for performing enhanced Identity administration activities. - AzureAD/MSIdentityTools
github.com
February 10, 2025 at 12:53 PM
Application consents:
- user education
- every consent should be HIGHLY SCRUTINIZED. Every one. Especially from multitenant apps.
- restrict non-admin users from consenting to 3rd party apps, even verified publishers
/1
- user education
- every consent should be HIGHLY SCRUTINIZED. Every one. Especially from multitenant apps.
- restrict non-admin users from consenting to 3rd party apps, even verified publishers
/1
@michaelepping.com has a great script you can find as part of Identity Tools (github.com/AzureAD/MSId...) and if you want a video walk through of it, @merill.net has you covered www.youtube.com/watch?v=vO0m.... /3
GitHub - AzureAD/MSIdentityTools: Repository for the Microsoft Identity Tools PowerShell module which provides various tools for performing enhanced Identity administration activities.
Repository for the Microsoft Identity Tools PowerShell module which provides various tools for performing enhanced Identity administration activities. - AzureAD/MSIdentityTools
github.com
November 8, 2024 at 4:37 PM
@michaelepping.com has a great script you can find as part of Identity Tools (github.com/AzureAD/MSId...) and if you want a video walk through of it, @merill.net has you covered www.youtube.com/watch?v=vO0m.... /3
So there actually is an MS Graph apI endpoint to resolve a domain name to a tenant ID and vice versa. This was a common ask so we added a sample cmdlet in the MSIdentityTools powershell module. See github.com/AzureAD/MSId...
GitHub - AzureAD/MSIdentityTools: Repository for the Microsoft Identity Tools PowerShell module which provides various tools for performing enhanced Identity administration activities.
Repository for the Microsoft Identity Tools PowerShell module which provides various tools for performing enhanced Identity administration activities. - AzureAD/MSIdentityTools
github.com
November 4, 2024 at 2:50 PM
So there actually is an MS Graph apI endpoint to resolve a domain name to a tenant ID and vice versa. This was a common ask so we added a sample cmdlet in the MSIdentityTools powershell module. See github.com/AzureAD/MSId...
- enable the admin consent flow
- educate admins about how these attacks work, even when "Low Risk" API permissions are consented
- if you don't have an SSPM or CASB, use
@merill's script to find Oauth2 consents in your tenant (you may be surprised how many there are) github.com/AzureAD/MSId...
/2
- educate admins about how these attacks work, even when "Low Risk" API permissions are consented
- if you don't have an SSPM or CASB, use
@merill's script to find Oauth2 consents in your tenant (you may be surprised how many there are) github.com/AzureAD/MSId...
/2
MSIdentityTools/src/Export-MsIdAppConsentGrantReport.ps1 at main · AzureAD/MSIdentityTools
Repository for the Microsoft Identity Tools PowerShell module which provides various tools for performing enhanced Identity administration activities. - AzureAD/MSIdentityTools
github.com
February 10, 2025 at 12:53 PM
- enable the admin consent flow
- educate admins about how these attacks work, even when "Low Risk" API permissions are consented
- if you don't have an SSPM or CASB, use
@merill's script to find Oauth2 consents in your tenant (you may be surprised how many there are) github.com/AzureAD/MSId...
/2
- educate admins about how these attacks work, even when "Low Risk" API permissions are consented
- if you don't have an SSPM or CASB, use
@merill's script to find Oauth2 consents in your tenant (you may be surprised how many there are) github.com/AzureAD/MSId...
/2
Use policy impact insights to find issues
For those unaware, more info here:
learn.microsoft.com/...
The MSIdentityTools module has a report for this, but it's incomplete. I made a PR, but be sure to use exported sign-in logs (online query doesn't work):
github.com/AzureAD/M...
For those unaware, more info here:
learn.microsoft.com/...
The MSIdentityTools module has a report for this, but it's incomplete. I made a PR, but be sure to use exported sign-in logs (online query doesn't work):
github.com/AzureAD/M...
August 16, 2025 at 4:15 AM
Use policy impact insights to find issues
For those unaware, more info here:
learn.microsoft.com/...
The MSIdentityTools module has a report for this, but it's incomplete. I made a PR, but be sure to use exported sign-in logs (online query doesn't work):
github.com/AzureAD/M...
For those unaware, more info here:
learn.microsoft.com/...
The MSIdentityTools module has a report for this, but it's incomplete. I made a PR, but be sure to use exported sign-in logs (online query doesn't work):
github.com/AzureAD/M...
🚨The #MSIdentityTools #PowerShell Module released several versions and is not at 2.7.0
bit.ly/3X0Be5Z
bit.ly/3X0Be5Z
November 18, 2025 at 9:52 PM
🚨The #MSIdentityTools #PowerShell Module released several versions and is not at 2.7.0
bit.ly/3X0Be5Z
bit.ly/3X0Be5Z
🚨New #MSIdentityTools #PowerShell Module 2.2.0 has been released
- fixes the Get-MsIdInactiveSignInUser commandlet
bit.ly/3M1EL1l
- fixes the Get-MsIdInactiveSignInUser commandlet
bit.ly/3M1EL1l
November 14, 2025 at 7:01 AM
🚨New #MSIdentityTools #PowerShell Module 2.2.0 has been released
- fixes the Get-MsIdInactiveSignInUser commandlet
bit.ly/3M1EL1l
- fixes the Get-MsIdInactiveSignInUser commandlet
bit.ly/3M1EL1l
November 18, 2023 at 9:28 AM
🚨A new version of #MSIdentityTools #PowerShell Module has been released to the #PowerShellGallery
bit.ly/40goFE5
bit.ly/40goFE5
October 28, 2023 at 8:36 AM
🚨A new version of #MSIdentityTools #PowerShell Module has been released to the #PowerShellGallery
bit.ly/40goFE5
bit.ly/40goFE5
>_ The Microsoft.Entra PowerShell module is updated to v1.2.0 with bug fixes and AgentId commands from MSIdentityTools. 🪪
Also: v1.1.0 removed the version pinning of Microsoft Graph PowerShell modules from 2.25.0 so you can use newer versions now. 👏 github.com/microsoft...
Also: v1.1.0 removed the version pinning of Microsoft Graph PowerShell modules from 2.25.0 so you can use newer versions now. 👏 github.com/microsoft...
January 15, 2026 at 9:58 PM
>_ The Microsoft.Entra PowerShell module is updated to v1.2.0 with bug fixes and AgentId commands from MSIdentityTools. 🪪
Also: v1.1.0 removed the version pinning of Microsoft Graph PowerShell modules from 2.25.0 so you can use newer versions now. 👏 github.com/microsoft...
Also: v1.1.0 removed the version pinning of Microsoft Graph PowerShell modules from 2.25.0 so you can use newer versions now. 👏 github.com/microsoft...
November 10, 2025 at 6:49 AM
August 23, 2024 at 10:08 PM
July 18, 2024 at 10:09 AM
July 12, 2024 at 2:02 PM
June 13, 2024 at 5:59 AM
May 26, 2024 at 1:37 PM
🚨New #MSIdentityTools #PowerShell Module 2.0.57 has been released.
Thanks @merill.net for accepting my #PullRequest 😊
bit.ly/3wNZwGD
Thanks @merill.net for accepting my #PullRequest 😊
bit.ly/3wNZwGD
May 24, 2024 at 10:28 AM
🚨New #MSIdentityTools #PowerShell Module 2.0.57 has been released.
Thanks @merill.net for accepting my #PullRequest 😊
bit.ly/3wNZwGD
Thanks @merill.net for accepting my #PullRequest 😊
bit.ly/3wNZwGD
February 1, 2024 at 12:01 PM
January 30, 2024 at 8:41 PM
December 1, 2023 at 9:57 AM
Nice write up. You may not want to solely filter on usertype since that dictates directory permissions and can be changed. I would also include invited users who have not redeemed or not signed in recently. I remember adding some cmdlets in this module to help admins here a few years ago
Command Reference | MSIdentityTools
azuread.github.io
December 16, 2024 at 2:47 PM
Nice write up. You may not want to solely filter on usertype since that dictates directory permissions and can be changed. I would also include invited users who have not redeemed or not signed in recently. I remember adding some cmdlets in this module to help admins here a few years ago
MSIdentityTools PowerShell Module 2.0.58 released via PlanetPowerShell
MSIdentityTools PowerShell Module 2.0.58 released
Just a few Hours ago, Microsoft has released a new Version of MSIdentityTools PowerShell Module
dlvr.it
June 5, 2024 at 8:41 AM
MSIdentityTools PowerShell Module 2.0.58 released via PlanetPowerShell
Had a question today about generating a report for app consent and remembered @merill posted something recently While his tweet is about -Parallel in PSv7, it's also a good reminder of some awesome capabilities in the MSIdentityTools PowerShell module 🔥
https://t.co/keUPwLiMTg https://t.co/uUfy...
https://t.co/keUPwLiMTg https://t.co/uUfy...
November 18, 2024 at 10:20 PM
Had a question today about generating a report for app consent and remembered @merill posted something recently While his tweet is about -Parallel in PSv7, it's also a good reminder of some awesome capabilities in the MSIdentityTools PowerShell module 🔥
https://t.co/keUPwLiMTg https://t.co/uUfy...
https://t.co/keUPwLiMTg https://t.co/uUfy...