Automating User Offboarding in Azure AD with PowerShell
One script that locks a departing user out, cleans up their groups and licenses, and keeps their mail, with a CSV record of every step.
Thread: The Microsoft Graph toolbox ↗2 min readRead note
Tagged · 12 notes
#Entra ID.
Everything tagged Entra ID, wherever it's filed, newest first.
Adding Domain Groups to Local Administrators on Remote PCs with PowerShell
Put a domain group into the local Administrators group on a list of computers (or take one out) over PowerShell remoting, with a result for every machine and -WhatIf first.
Thread: Local admin, done right ↗2 min readRead note
Report on Everything an Entra ID Group Touches with Microsoft Graph
Before you rename, rescope or delete a group, find out what it's wired to. Members, owners, licenses, apps and Intune policies, in one report.
Thread: The Microsoft Graph toolbox ↗2 min readRead note
Create a Dedicated Local Admin Account for Windows LAPS to Manage
Roll out a named local admin account with a random password nobody knows, ready for Windows LAPS to take over, and optionally retire the built-in Administrator.
Thread: Local admin, done right ↗2 min readRead note
Trigger Intune Automatic Enrollment on a Windows Device with PowerShell
For the Entra-joined PC that never showed up in Intune. Check it's ready, kick off enrollment, and see why it failed if it does.
Thread: Getting devices into Intune ↗2 min readRead note
Pre-Register MFA Phone Numbers for Entra ID Users with PowerShell
Load mobile numbers into Entra ID as an authentication method before users ever sign in, without stomping on numbers they've already registered.
Thread: The Microsoft Graph toolbox ↗2 min readRead note
Microsoft Intune, Before You Enroll Anything: What It Does and What to Plan
A plain-spoken tour of what Intune actually handles, where it stops, and the identity decisions you want settled before the first device shows up.
Thread: Getting devices into Intune ↗4 min readRead note
How to Enroll a Windows Device in Intune by Hand
The Settings app route into Intune, which of its three options to pick, and why the device might show up as personal when you didn't want it to.
Thread: Getting devices into Intune ↗4 min readRead note
Checklist: Moving a Device from MDE Security Settings Management to Intune
A practical checklist for taking a device that gets its security policy through Defender for Endpoint and enrolling it in Intune without leaving a gap.
Thread: Getting devices into Intune ↗4 min readRead note
Set Extension Attributes on Entra ID Users with PowerShell
Write extensionAttribute1-15 on cloud-only Entra ID users from a CSV, with a clear note for every synced account it can't touch.
Thread: The Microsoft Graph toolbox ↗2 min readRead note
Defender for Endpoint vs. Intune: Who Actually Manages the Device?
Onboarding to Defender for Endpoint and enrolling in Intune are two different things, and you almost never have to offboard one to get the other.
Thread: Getting devices into Intune ↗3 min readRead note
Rotate Local Admin Passwords Across the Fleet with Windows LAPS and ConfigMgr
Force an immediate local admin password rotation on every machine in a collection, with Windows LAPS doing the password part so no script ever sees one.
Thread: Local admin, done right ↗2 min readRead note