Ms365 Tenant Manager

What This Skill Does

When to Use

Run security audits on the tenant. Bulk provision users from a C

• SV file.

• Create conditional access policies.

• Configure D.

• NS records for the tenant.

• Manage user licenses and subscriptions.

• Automate tenant setup tasks.

Key Features

Provides Power

• Shell scripts for common tasks.
• Offers guidance on setting up new tenants.
• Automates user provisioning and management.
• Helps configure security policies.
• Provides workflows for tenant optimization.
• Integrates with Microsoft Graph A.

PI.

Manual Installation

Manual installation

View Full Skill Content

The complete markdown content that gets installed

Microsoft 365 Tenant Manager

Quick Start

Run a Security Audit

Connect-Mg

• Graph -Scopes "Directory.

• Read.

• All","Policy.

• Read.

• All","Audit.

• Log.

• Read.

• All". Get-Mg

SubscribedSku | Select-Object Sku

PartNumber, Consumed

Units, @{N="Total";E={$_.Prepaid

Units. Enabled}} Get-Mg

PolicyAuthorizationPolicy | Select-Object Allow

InvitesFrom, Default

UserRolePermissions

Bulk Provision Users from C

SV

Import-Csv .\new_users.csv | For

Each-Object { $password

Profile = @{ Password = (New-Guid).To

String().Substring(0,16) + "!"; Force

ChangePasswordNextSignIn = $true } New-Mg

User -Display

Name $_.Display

Name -User

PrincipalName $_.User

PrincipalName -Department $_.Department -Account

Enabled -Password

Profile $password

Profile }

$policy = @{ State = "enabled

ForReportingButNotEnforced" # Start in report-only mode Conditions = @{ Users = @{ Include

Roles = $admin

Roles } } Grant

Controls = @{ Operator = "OR"; Built

InControls = @("mfa") } } New-Mg

IdentityConditionalAccessPolicy -Body

Parameter $policy

Workflows

Workflow 1: New Tenant Setup

Step 1: Generate Setup Checklist

Confirm prerequisites before provisioning: Custom domain purchased and accessible for D

NS edits

Step 2: Configure and Verify D

NS Records

After adding the domain in the M365 admin center, verify propagation before proceeding

$domain = "company.com" Resolve-Dns

Name -Name "_msdcs.$domain" -Type NS -Error

Action Silently

Continue Also run from a shell prompt: nslookup -type=MX company.com nslookup -type=T

XT company.com # confirm S

PF record

Wait for D

NS propagation (up to 48 h) before bulk user creation.

Step 3: Apply Security Baseline

Disable legacy authentication (blocks Basic Auth protocols)

$policy = @{ Display

Name = "Block Legacy Authentication" State = "enabled" Conditions = @{ Client

AppTypes = @("exchange

ActiveSync","other") } Grant

Controls = @{ Operator = "OR"; Built

InControls = @("block") } } New-Mg

IdentityConditionalAccessPolicy -Body

Parameter $policy

Enable unified audit log

Step 4: Provision Users

$license

Sku = (Get-Mg

SubscribedSku | Where-Object { $_.Sku

PartNumber -eq "E

NTERPRISEPACK" }).Sku

Id

Import-Csv .\employees.csv | For

Each-Object { try { $user = New-Mg

User -Display

Name $_.Display

Name -User

PrincipalName $_.User

PrincipalName -Account

Enabled -Password

Profile @{ Password = (New-Guid).To

String().Substring(0,12)+"!"; Force

ChangePasswordNextSignIn = $true } Write-Host "Provisioned: $($_.User

PrincipalName)" } catch { Write-Warning "Failed $($_.User

PrincipalName): $_" } }

Validation: Spot-check 3–5 accounts in the M365 admin portal; confirm licenses show "Active."

Workflow 2: Security Hardening

Step 1: Run Security Audit

Connect-Mg

• Graph -Scopes "Directory.

• Read.

• All","Policy.

• Read.

• All","Audit.

• Log.

• Read.

• All","Reports.

• Read.

• All".

Export Conditional Access policy inventory Get-Mg

IdentityConditionalAccessPolicy | Select-Object Display

Name, State | Export-Csv .\ca_policies.csv -No

TypeInformation

Find accounts without M

FA registered $report = Get-Mg

ReportAuthenticationMethodUserRegistrationDetail $report | Where-Object { -not $_.Is

MfaRegistered } | Select-Object User

PrincipalName, Is

MfaRegistered | Export-Csv .\no_mfa_users.csv -No

TypeInformation

• Write-Host "Audit complete. Review ca_policies.csv and no_mfa_users.csv.".

Step 2: Create M

FA Policy (report-only first)

$policy = @{ Display

Name = "Require M

FA All Users" State = "enabled

ForReportingButNotEnforced" Conditions = @{ Users = @{ Include

Users = @("All") } } Grant

Controls = @{ Operator = "OR"; Built

InControls = @("mfa") } } New-Mg

IdentityConditionalAccessPolicy -Body

Parameter $policy

Validation: After 48 h, review Sign-in logs in Entra ID; confirm expected users would be challenged, then change State to "enabled".

Step 3: Review Secure Score

Retrieve current Secure Score and top improvement actions

Get-Mg

SecuritySecureScore -Top 1 | Select-Object Current

Score, Max

Score, Active

UserCount Get-Mg

SecuritySecureScoreControlProfile | Sort-Object -Property Action

Type | Select-Object Title, Implementation

Status, Max

Score | Format-Table -Auto

Size

Workflow 3: User Offboarding

Step 1: Block Sign-in and Revoke Sessions

$upn = "departing.user@company.com" $user = Get-Mg

User -Filter "user

PrincipalName eq '$upn'"

Block sign-in immediately Update-Mg

User -User

Id $user. Id -Account

Enabled:$false

Revoke all active tokens Invoke-Mg

InvalidateAllUserRefreshToken -User

Id $user. Id Write-Host "Sign-in blocked and sessions revoked for $upn"

Step 2: Preview with -What

If (license removal)

Identify assigned licenses

Dry-run: print what would be removed $licenses | For

Each-Object { Write-Host "[What

If] Would remove S

KU: $_" }

Step 3: Execute Offboarding

Remove licenses

Convert mailbox to shared (requires Exchange

OnlineManagement module) Set-Mailbox -Identity $upn -Type Shared

Remove from all groups Get-Mg

UserMemberOf -User

Id $user. Id | For

Each-Object { try { Remove-Mg

GroupMemberByRef -Group

Id $_.Id -Directory

ObjectId $user. Id } catch {} } Write-Host "Offboarding complete for $upn"

Validation: Confirm in the M365 admin portal that the account shows "Blocked," has no active licenses, and the mailbox type is "Shared."

Best Practices

Tenant Setup

Enable M

FA before adding users Configure named locations for Conditional Access Use separate admin accounts with P

IM Verify custom domains (and D

NS propagation) before bulk user creation Apply Microsoft Secure Score recommendations

Security Operations

Start Conditional Access policies in report-only mode Review Sign-in logs for 48 h before enforcing a new policy Never hardcode credentials in scripts — use Azure Key Vault or Get-Credential Enable unified audit logging for all operations Conduct quarterly security reviews and Secure Score check-ins

Power

Shell Automation

Prefer Microsoft Graph (Microsoft. Graph module) over legacy M

SOnline Include try/catch blocks for error handling Implement Write-Host/Write-Warning logging for audit trails Use -What

If or dry-run output before bulk destructive operations Test in a non-production tenant first

Reference Guides