Using Microsoft Graph API with Windows PowerShell to Monitor and Manage Microsoft 365 Clients. Microsoft Graph provides a unified API layer across Microsoft Entra ID, Intune, Microsoft 365, and security services, making it the preferred way to monitor users, devices, compliance, and activity at scale. In this video, we'll go over how MSP technicians and IT administrators can use Microsoft Graph with Windows PowerShell to monitor and manage Microsoft 365 environments. Before we begin, be sure to subscribe to NinjaOne's IT video hub and our YouTube channel for more tech content like this. How to Monitor and Manage M365 Clients with Microsoft Graph API. In this next section, we'll provide a high-level overview of common Microsoft Graph API method so that you get a sense of what's possible. For full scripts, advanced examples, and production-ready automation workflows, refer to our blog post. Install Microsoft Graph PowerShell SDK. Make sure you're running PowerShell 7 or later, have an updated version of PowerShellGet, have .NET Framework 4.7.2 or later installed, and are using an execution policy that allows signed scripts. From there, open an elevated PowerShell session and enter. This installs the SDK without impacting other user profiles, which is ideal for shared systems or jump boxes. Connect to Microsoft Graph PowerShell SDK. Graph access is permission-based, so connections should always follow least-privilege principles whenever possible. To connect with read access for users, devices, and directories, you can use. You'll be prompted to authenticate and consent to the requested scopes. Graph also supports tenant-specific connections and registered app authentication. Retrieve Device Information and Compliance Status. One of the most common Graph use cases is Intune device visibility. You can quickly retrieve managed devices and their compliance state. To examine device posture across tenants, use this. From there, filtering for non-compliant devices helps prioritize remediation and reduce risk. Monitor User Activity and Licensing. User visibility is another area where Graph excels: you can retrieve users and assigned licenses in a single query. This command lists all users along with their assigned licenses. Graph also allows access to sign-in records when audit log permissions are granted. This is critical for investigating suspicious activity. Automate Remediation and Policy Enforcement. If a device is lost or compromised, Graph allows you to trigger actions directly. For example, wiping a device can be done programmatically: When combined with alerts from RMM tools or Microsoft Defender, Graph becomes a powerful remediation engine rather than just a reporting interface. Validate Policies at Endpoint Level. Graph issues policies, but endpoint validation still matters. Configuration Service Provider settings can be confirmed in the PolicyManager registry hive under... You can also force MDM enrollment or validate join status using built-in Windows commands. These checks are especially useful during troubleshooting or staged deployments. Secure Token Usage with GPO and Endpoint Controls. On managed systems, Local Group Policy can reduce credential exposure by preventing credential storage and enforcing signed PowerShell scripts. This limits token theft, script tampering, and unauthorized automation. Restricting script execution to signed scripts ensures that only trusted automation runs on production systems. When combined with PowerShell, Microsoft Graph enables scalable monitoring, automation, and enforcement across users, devices, and security controls. For more information, check out our official blog post on using Microsoft Graph API with Windows PowerShell to monitor and manage Microsoft 365 clients, linked in the description below.