ProtocolBound

Entra and Intune commands

Graph PowerShell for users, groups, licenses and Intune devices.

How to use it

  1. Copy the connection block at the top and run it in PowerShell. The first run installs the Microsoft Graph module.
  2. Sign in with an admin account and accept the permissions.
  3. Pick a task, fill in the user, group or device, and copy the command into the same window.

Users

  • Look up a user
  • Disable a user: For synced users, disable in on-prem AD instead.
  • Reset a password and force change: Cloud-only accounts. Synced accounts are reset in AD.
  • Sign a user out everywhere: Revokes refresh tokens. Apps may keep access until their token expires (about an hour).
  • List MFA methods
  • Last sign-ins for a user: Error code 0 means success. Look up others in Error code lookup.
  • Users with no sign-in in 90 days: Needs AuditLog.Read.All and Entra ID P1.
  • List deleted users (recycle bin): Deleted users stay here for 30 days, then are gone for good. Copy the Id of the one to bring back. A deleted user's UPN starts with its object ID, so look at the end of the UPN.
  • Restore a deleted user: Use the Id from "List deleted users". Brings back the account with its groups and licenses, then shows it to confirm. Only works within 30 days of deletion. If the UPN or email is now used by…

Groups and licenses

  • List group members
  • Add a user to a group
  • See a user's licenses
  • List licenses in the tenant
  • Assign a license: The user needs a usage location set first.

Devices

  • Find an Intune device
  • Devices for a user
  • Which device a user signed in from: Shows the device name reported with each recent sign-in, newest first. Needs AuditLog.Read.All. If Device is blank, that sign-in came from a browser or app Entra couldn't tie to a managed device.
  • Non-compliant devices
  • Push a sync to a device
  • Retire a device: Removes company data and management. Does not wipe personal data.
  • BitLocker recovery key: Needs BitlockerKey.Read.All. Reading a key is logged in the audit log.

On the device

  • Join and registration status: Look for AzureAdJoined, DomainJoined and AzureAdPrt.
  • Force an Intune app sync
  • Collect MDM diagnostics
  • Open the Intune app logs
  • Show the Autopilot hardware hash