Active Office 365 Cmd | 8K - 480p |
Connect-MgGraph -Scopes "User.Read.All", "AuditLog.Read.All" Get-MgUser -All | Where-Object $_.SignInActivity -eq $null Uncovers service accounts, terminated employees not disabled, or shared mailboxes being used for illicit access. 3.2 License Audit – Who’s Wasting Money? Get-MgUser -All -Property Id,DisplayName,AssignedLicenses | Select-Object DisplayName, @N="Licenses";E=$_.AssignedLicenses.SkuId -join ", " | Where-Object $_.Licenses -ne "" Output: Every user with their assigned product SKUs. Run this weekly to catch ghost licenses. 3.3 Bulk Mailbox Actions (Like Old cmd but Powerful) Add "Legal Hold – Project X" to all members of a distribution group:
| Component | Role | |-----------|------| | | Cross-platform shell | | Microsoft Graph PowerShell SDK | Modern API-based commands | | Exchange Online V3 module | Mailbox-specific controls | | SharePoint Online Management Shell | SPO site management |
while($true) Clear-Host Write-Host "=== Office 365 Active CMD Monitor ===" -ForegroundColor Cyan Write-Host "Time: $(Get-Date)" $activeUsers = Get-MgUser -All This mimics top or htop but for your tenant. 5.1 Find All Admin Role Assignments (Who can wreck your tenant) Get-MgRoleManagementDirectoryRoleAssignment | Where-Object $_.RoleDefinitionId -eq "Global Administrator" | Select-Object PrincipalId, RoleDefinitionId 5.2 Detect Mailbox Forwarding (Common data exfiltration) Get-Mailbox -ResultSize Unlimited | Where-Object $_.ForwardingSmtpAddress -ne $null | Select-Object DisplayName, ForwardingSmtpAddress, DeliverToMailboxAndForward Interesting finding: Many attackers set DeliverToMailboxAndForward = $true to keep the user unaware. 6. Automation Script – "Office 365 Daily Health Check" Save as O365-Health.ps1 and run daily via Task Scheduler or cron: active office 365 cmd
The "CMD" of yesterday has evolved into a programmable, powerful interface that gives you complete control over your tenant. Final command to try right now: Connect-MgGraph -Scopes "User.Read.All" Get-MgUser -Top 10 | Format-List DisplayName, UserPrincipalName End of Report
@echo off curl -X GET "https://graph.microsoft.com/v1.0/users" -H "Authorization: Bearer %ACCESS_TOKEN%" You can get %ACCESS_TOKEN% via az account get-access-token (Azure CLI) or Connect-MgGraph then extract token. | GUI | Active CMD | |-----|-------------| | Slow navigation | Instant execution | | Error-prone clicks | Scriptable, repeatable | | Hidden properties visible only via UI | Full object properties exposed | | Manual audit | Scheduled automation | Connect-MgGraph -Scopes "User
Want to run this interactively? Save this report as Invoke-O365CmdDemo.ps1 and explore.
Legacy modules ( MSOnline , AzureAD , ExchangeOnlineManagement older versions) are as of 2024–2026. 3. Interesting Active Commands (Live Examples) 3.1 User Reconnaissance – Find "Hidden" Accounts List all users who have never logged in (inactive security risk): Run this weekly to catch ghost licenses
# Report summary Write-Output "=== O365 Health Report $(Get-Date) ===" Write-Output "Users: $(Get-MgUser -All).Count" Write-Output "Disabled users: $(Get-MgUser -All | Where-Object $_.AccountEnabled -eq $false).Count" Write-Output "Guest accounts: $(Get-MgUser -All | Where-Object $_.UserType -eq 'Guest').Count" Write-Output "Mailboxes > 90GB: $((Get-Mailbox -ResultSize Unlimited | Get-MailboxStatistics | Where-Object $_.TotalItemSize.Value.ToGB() -gt 90).Count)" Though limited, native cmd can still interact with O365 via curl to Graph API with a token:
