Introduction
In this article, I describe one of the most elaborate scripts I have ever written for the community.
This script is about defining a standard for how a tenant assessment can be carried out.
Everyone who works as a consultant, solution architect or similar in the Microsoft 365 world faces more or less similar challenges.
On the one hand, we have to analyze the current situation of the customer tenants from time to time. I am thinking of the following examples, among others:
- Are there users that are excluded from a conditional policy?
- Are there admin accounts that have assigned licenses?
- How many licenses of what type are unassigned on the tenant?
- Which domains are registered on the tenant?
- and so on.
These and other points can be analyzed easily, but this is time-consuming depending on the scope.
Another example is when a new tenant is to be inboarded, which configurations already exist at the new customer?
In order to simplify and standardize these tasks, I have written a corresponding script that compiles the most important points for us in an HTML report.
PowerShell Modules
This script is based on the following PowerShell modules:
- Microsoft.Graph.Authentication
- Microsoft.Graph.Identity.DirectoryManagement
- Microsoft.Graph.Identity.SignIns
- ExchangeOnlineManagement
- MicrosoftTeams
- Microsoft.Graph.Reports
- Microsoft.Graph.Sites
- Microsoft.Graph.Groups
- Microsoft.Graph.Users
When the script is executed, it checks whether the required modules are already installed. If this is not the case, the script installs the missing modules automatically.
Authorizations
Since the PowerShell uses Microsoft Graph as in the previous chapter, the corresponding authorizations are of course also required. In summary, the following Graph permissions are required for the successful execution of the script:
- Directory.Read.All
- Organization.Read.All
- User.Read.All
- Group.Read.Al
- Application.Read.All
- Policy.Read.All
- Reports.Read.All
- Sites.Read.All
- TeamSettings.Read.All
- MailboxSettings.Read
- AuditLog.Read.All
- DeviceManagementManagedDevices.Read.All
As this script is an assessment script, no write permissions are required. This means that nothing is changed in the current configuration.
What is analyzed with this script?
The following tasks are performed with the script:
- Connected to Exchange Online. Retrieving mailbox information…
- Collecting Microsoft Teams configuration…
- Connected to Microsoft Teams. Retrieving teams and policies…
- Collecting Entra ID configuration…
- Collecting access authorizations and guest access information…
- Collecting security policies…
- Collecting Intune configuration…
- Collecting MFA status…
- Collecting license information…
- Collecting Teams Phone configuration…
- Collecting registered domains…
- Collecting public DNS settings…
- Collecting all Microsoft Teams teams…
- Collecting SharePoint sites…
- Collecting SharePoint sites with external sharing…
Further information
While the script is running, every single point that is currently being analyzed by the script is displayed in the PowerShell Console.
While the script is performing its tasks, there will be 4 login prompts. These are required depending on the module used and the progress of the assessment.
Get the Script
As always, although I have tested and used the script several times, I cannot and will not accept any liability for the use of this script.
Readers who download the script are free to customize it according to their needs. Commercial use is allowed, but monetarization requires my explicit permission.
Application example
After the assessment has run successfully, an HTML file is stored under C:\Temp. This file has the name: M365TenantAssessment.html
Here are some screenshots of what a report looks like.
 |
 |
 |
 |
Conclusion
I hope I can make your daily work a little easier with this script. Even though I have already tested and used the script countless times, I recommend that you run it in a test tenant the first time you run it.
I make no guarantees for any problems that may occur.
