►
Description
In this 19-minute developer focused demo – Nik Charlebois delivers a quick tour of PowerShell Gallery (powershellgallery.com) – install modules, see how authentication works (both in Delegated and App-only permissions scenarios for any CRUD operation), find permissions (discover cmdlets based on URLs, identify permissions required for apps based on cmdlets used), differentiate between beta and v1 endpoints, obtain Auth sign-in information and run reports using Out-GridView that dumps results into CSV file. Gallery has 40+ PowerShell modules, 17,500+ cmdlets, and supports PowerShell 5.1 and 7+. This PnP Community demo is taken from the weekly Microsoft 365 Platform Community call recorded on June 21, 2022.
Demo Presenter
• Nik Charlebois (Microsoft) | @NikCharlebois
Supporting materials
• SDK - Microsoft Graph PowerShell SDK | https://github.com/microsoftgraph/msgraph-sdk-powershell
• PowerShell Gallery - Welcome to the PowerShell Gallery | Powershellgallery.com
• Documentation - Out-GridView | https://docs.microsoft.com/powershell/module/microsoft.powershell.utility/out-gridview?view=powershell-7.2
Learn more
• Microsoft 365 Unified Sample gallery - https://aka.ms/m365/samples
• Microsoft 365 Platform Community in YouTube - https://aka.ms/m365/videos
• Microsoft 365 Platform Community - http://aka.ms/m365/community
A
Glad
to
be
presenting
to
you
folks
today
on
this
very
first
day
of
summer.
It
doesn't
look
anything
like
summer,
where
I
am
I'm
actually
located
in
ottawa,
canada,
and
it
is
a
cold
15
degrees.
Right
now
I
am
a
senior
program
manager
on
the
microsoft
graph
team.
I'm
also
I'm
focusing
more
on
the
component
called
microsoft
graph
data
connect,
which
is
a
way
for
you
to
extract
data
in
bulk
and
I'm
also
the
principal
lead
and
creator
for
the
microsoft
365
desired
state
configuration
tool.
A
A
What
I
want
to
do
is
I
want
to
just
quickly
do
a
quick
overview
of
what
the
module
actually
is.
It
is
something
that's
available
right
now
in
the
official
powershell
gallery,
for
those
of
you
that
are
not
familiar
with
the
powershell
gallery,
you
can
go
to
powershellgallery.com,
so
this
is
a
microsoft
owned
website
where
we
publish
all
of
the
yes,
it's
15
celsius,
brian
very
important.
A
I
should
have
mentioned
that
I'm
in
canada,
so
we
talk
celsius
but
the
so
it
is
available
in
the
fireshell
gallery
and
essentially
what
it
allows
you
to
do
is
to
install
the
any
modules
that
we
published
with
a
simple
command
right.
So
you
can
go
and
install
module,
for
example,
microsoft,
365
dsc
it
will
go
and
will
automatically
download
the
bits
from
the
powershell
gallery
and
install
them
on
your
machine.
A
Now,
microsoft
graph
is
a
a
group
of
about
40
plus
different
powershell
modules
right
in
total
they
make
for
about
660
meg
of
powershell
goodness.
So
when
you're
you're
writing
your
own
scripts,
it's
really
important
that
you
only
pick
the
ones
you
want
unless
you
want
to
install
the
whole
thing,
be
my
guest.
However,
normally
when
you
write
your
scripts
you're
going
to
go
in
and
let's
say,
you're
trying
to
interact
with
emails,
you're
going
to
go
and
install
the
microsoft
draft.mail
module
only,
which
is
only
about
10
magazine
sites.
A
A
A
The
permissions
for
the
commandlets
are
going
to
be
driven
by
azure
id,
so
you
go
in
and
you
create
your
azure
id
application
registration
and
then
you
can
either
grant
delegated
or
app-only
permissions
like
you
would,
if
you're
writing
any
application.
That
would
call
the
rest
apis
and
automatically,
as
I
mentioned
right
when
we
on
board
new
api.
A
So
when
new
features
are
being
rolled
out
or
when
new
workloads
are
being
migrated
over
to
microsoft
graph,
we
automatically
provide
powershell
support,
so
we
essentially
wrap
it
directly
inside
of
a
powershell
command
list,
so
it's
always
up
to
date.
So
when
we
have
it
on
microsoft
graph,
we
have
it
in
the
powershell
module.
Another
thing,
that's
really
important
to
note
is
that
it
is
open
source
on
github.
A
A
If
you're
trying
to
understand
right,
because
there
are
so
many
modules,
there
are
over
17
000
different
commandlets,
let's
say
you're
trying
to
get
user
emails
right
and
you
know
that
the
command
you're
looking
for
is
the
get
dash.
Ng
ng
stands
for
microsoft,
graph
user
message,
but
you
don't
know
what
module
you
actually
need
right
and
eric.
Yes,
there
are
many
partial
modules,
but
we're
making
it
easier
for
you
to
figure
out
what
module
you
actually
need
right.
A
What
I'm
going
to
do
here
is,
I
actually
have
a
few
modules
that
I
need
to
install
for
my
demos,
so
I'm
going
to
go
in
I'm
going
to
install
the
main
one
that
you
will
need
for
any
script
is
the
grab
that
authentication
one,
that's
the
core
module
for
the
microsoft
graph,
firestop
sdk.
That
will
allow
you
to
go
and
obtain
the
token
from
the
microsoft
graph
right.
So
this
is
what
you
would
use
to
go
and
connect
essentially
to
microsoft
graph.
A
In
my
case,
I'm
going
to
go
and
grab
about
five
different
modules,
directory
management's,
probably
more
like
six
or
seven,
the
mail,
the
reports,
the
teams
and
the
actual
users,
and
I'm
going
to
go
and
use
that
install
module
command
that
I
mentioned.
So
what
I'm
going
to
do
is
I'm
going
to
go
and
I'm
going
to
run
this
and
what's
happening
in
the
back
end.
You
can
see
it
here
where
it's
actually
downloading
the
modules
from
the
powershell
gallery
and
installing
them
on
my
machine.
A
What
installing
means
in
this
context
here
it's
essentially
downloading
it
as
a
zip
and
extracting
it
in
a
specific
folder,
and
that
folder
is
under
c
program
files
windows,
firestone
module
when
you're
installing
it
for
all
users
right.
You
have
the
choice
of
powershell
7
to
go
and
install
it
directly
inside
of
your
users
folder,
but
normally
these
full.
These
modules
would
just
get
exported
in
there
and
if
you
take
a
look
at
the
various
modules,
all
you
see
is
that
those
are
actual
powershell
modules
right.
A
So
there's
no
binaries
being
installed,
it's
just
downloading
powershell
modules
and
putting
them
in
that
location.
So
now
that
we
have
everything
installed,
what
I
want
to
show
you
is
how
authentication
works.
The
first
thing
I'm
going
to
do
is
I'm
going
to
be
connecting
to
microsoft
graph
using
a
delegated
scope,
so
I'm
going
to
be
connecting
using
the
connect
mg
graph
command
and
I'm
going
to
be
specifying
the
scope,
the
permission
scopes.
I
want
my
user
to
get
in
this
case.
A
I'm
gonna
go
and
get
mail.read,
and
you
know
what
I
don't
even
need
this
here,
because
I
did
update
my
my
demo,
so
I'm
gonna
go
and
do
mail.read.
So
let's
do
this
here.
Real
quick,
I'm
actually
just
gonna,
make
sure
I'm
not
connected
to
any
other
sessions,
I'll
connect
to
microsoft
graph,
it's
going
to
prompt
me
for
my
username
and
password.
So
in
my
case,
I'm
already
connected
with
my
account.
A
Connect
I've
acquired
the
actual
token,
and
now
I
can
go
in
and
do
operations
against
the
graph.
What
I'm
going
to
be
doing
here
is
I'm
going
to
be
calling
it
to
the
get
mg
user
message
commandlet
and
passing
in
my
user,
the
user
I
actually
connected
to
microsoft
graph
with
and
I'm
going
to
be
retrieving
the
emails
at
least
the
top
10
emails
for
that
user,
and
I'm
just
going
to
be
printing
out
the
subject
for
those
emails.
So
let's
run
this
here
and
I'll
come
back
with
the
subject
of
the
last
10
messages.
A
Right.
Most
of
them
are
actual
pam
privilege
access
management
request,
but
I
can
see
that
I
managed
to
go
and
extract
emails
now,
if
I
try
to
do
the
same
thing
and
get
the
emails
for
another
user,
so
good
old
adele
in
my
demo
tenant
I'm
going
to
go
in
here
and
try
to
connect
to
this
and
I'm
going
to
get
an
access.
A
A
Now,
let's
take
a
look
at
app-only
authentication,
so
I'm
going
to
go
in
I'm
going
to
disconnect
here
and
what
I've
done
is
I've
actually
inside
of,
I
should
have
done
this
here.
Instead
inside
of
azure
id,
I
created
a
new
app
registration
called
nick
powershell
app
only
and
for
that
app
I've
actually
granted
some
application
level
permissions.
A
Those
are
mail.readwrite,
that's
the
one
we're
really
interested
in
these
are
going
to
be
useful
for
other
demos
later
on,
but
essentially
what
I've
done
is
I
granted
mail.read
application
right
for
that
application
in
my
powershell
script?
What
I'm
going
to
do
next
is
I'm
actually
going
to
go
and
authenticate
using
that
app
id
right.
The
client
id
here
I
do
have
a
certificate
that's
installed
and
I'm
going
to
connect
that
that
tenant
id.
So,
let's
let
me
obtain
that
app
only
token
perfect
yeah.
I
already
disconnected
perfect
so
now.
A
Let's
do
the
same
thing
I'm
going
to
go
and
I'm
going
to
get
the
messages
or
the
emails
for
the
nic
users.
So
my
account
it's
coming
back
with
my
10
top
emails,
but
we
were
able
to
do
that
with
delegated.
Now,
if
I
go
in
and
try
to
get
the
messages
for
adele
I'll
be
able
to
get
her
email
which
are
different
than
the
ones
nick
had,
of
course,
because
I'm
now
authenticated
as
a
service
principal
using
app.
Only
permissions
are
the
powershell
modules
pre-installed
with
azure
shell.
A
I
believe
they
are
now.
I
need
to
double
check
that
I'll
have
to
confirm
that,
but
last
I
checked,
and
actually
that
should
be
fairly
easy
for
for
me
to
check.
I
see
vasa
the
eyes
on
the
call
based
on,
if
you
don't
mind,
just
go
in
and
double
checking,
but
last
I
heard
the
the
microsoft
graph
modules
were
available
with
the
azure
cloud.
Shell.
A
Let's
move
on
to
another
thing
right,
so
I
did
mention
that
any
endpoints
had
powershell
commandlets
exposed
for
them,
so
essentially
so,
and
so
we
can
do
crowd
operations
in
this
case
here.
What
I'm
going
to
be
doing
is
I'm
going
to
be
connecting
using
delegated
permissions,
I'm
going
to
be
using
the
scope,
chat.read
write,
which
essentially
allows
me
to
send
messages.
A
A
A
Great
moving
on
how
do
you
find
permissions
this
here
is
something
we
have
been
asking
for
months
before
they
actually
released
it
right,
so
the
partial
graphics
it
was
released.
If
I
remember
correctly,
sometimes
in
2020
this
fine
mg
graph
command
was
released
with
version
1.7
just
a
few
months
back,
but
it
allows
you
to
go
and
discover
the
various
commandlets
based
on
urls
and
also
identify
what
permissions
your
apps
are
going
to
be,
requiring
based
on
the
command
list.
You're
using.
A
Let
me
give
you
an
example,
so
let's
say
you're
going
in
and
the
first
thing
everybody
should
be
doing
when
they're
trying
to
learn
microsoft
graph
is
go
to
the
graph
explorer
you
go
to
the
graph
explorer
and
in
my
case
I'm
trying
to
go
and
understand
all
right.
I
want
to
get
all
the
security
alerts
from
my
environment.
So,
if
I
go
in
here,
I
can
see
that
the
url,
for
this
is
slash
security,
slash
alerts,
okay,
so
that's
the
url
for
the
graph
rest
apis.
A
So
what
I
can
do
now
is
using
this
find
mg
graph
command.
I
can
go
in
and
say
right
find
the
commands
that
are
associated
with
this
uri,
that
is
the
security,
slash
alerts,
and
if
I
run
this,
it's
going
to
come
back
and
it's
going
to
tell
me
all
right
here:
are
the
commandlets
you're
looking
for
the
get
ng
security
alert
and
the
new
mg
security
alert?
A
If
we
take
this
a
step
further,
I
want
to
understand
right.
That's
all
good,
but
like
what
permissions
do
I
actually
need?
This
is
another
example
where
we're
going
to
be
trying
to
get
information
about
the
get
mg
directory
setting
command
right,
get
mg
directory
setting
is
is
a
way
for
me
to
actually
be
able
to
get
different
policies
from
my
azure
id.
So
I'm
going
to
go
and
run
this,
but
this
time
I'm
going
to
go
and
select
the
permissions
from
the
return.
A
So
if
I
run
this
here,
it's
going
to
come
back
and
it's
going
to
tell
me
all
right
if
you're
trying
to
use
the
get
ng
directory
setting
here
are
the
permissions
you
need.
The
reason
why
I
have
two
by
the
way
is
because
this
is
available
on
so
there's.
Actually,
a
new
and
a
get
there
right,
but
I'm
going
to
be
able
to
see
that
all
right,
so
the
least
permission
you
need
is
directory
that
access
as
user.all
and
it's
always
from
left
to
right
right.
A
The
least
like
the
the
lowest
level
of
permission
you
need
is
directory
that
access
users.all
and
the
permission
that
will
grant
you
access
to
more
than
what
you
actually
are
looking
for.
Probably
is
the
directory
that
read
write
all,
but
it's
always
from
left
to
right
thanks
very
soon.
So
all
right,
so
I
thought
it
was
installed
by
default,
but
I'll
double
check
with
the
team
but
yeah
all
right.
A
A
Let
me
connect
again
I'm
going
to
be
using
a
delegated
scope,
I'm
going
to
be
using
the
directory.
The
read
write
all
so,
which
is
the
top
permission
that
I
need
I'm
going
to
go
and
connect.
This
prompt
me
for
my
username
again
get
my
token,
I'm
all
good.
Now,
I'm
going
to
go
in
and
I'm
actually
going
to
try
to
call
into
the
get
mg
directory
setting
command
like
we
know
this
exists
like
we
were
able
to
get
information
about
it.
A
So
I'm
going
to
go
and
run
this
right,
and
it's
going
to
come
back
with
an
error
saying
yeah
that
command
like
we
don't
recognize
it
as
the
name
of
the
command
line,
but
I
know
it
exists
right.
Why
is
that?
Well,
that's
because
it's
only
available
in
the
beta
endpoint
right
now.
The
way
you
can
tell
what
current
profile
you're
running
partial
under
is
by
using
the
get
ng
profile,
so
I
can
see
that
I'm
currently
connected
or
using
the
v1
profile.
A
It
will
load
different
command.
Let's,
based
on
my
selection,
shouldn't
be
taking
that
long
perfect.
Now
I
can
just
confirm
that
yeah
all
right,
I'm
now
running
better
and
if
I
go
in
and
do
get
ng
directory
settings
now,
I
can
actually
get
the
information
back
and
I
can
do
things
like
set
the
group's
naming
policy.
I
can
go
in
and
do
the
groups
lifecycle
management
as
well.
A
How
can
you
can
you
actually
create
a
script
that
will
go
and
monitor
all
the
sign-ins
against
your
environment
to
detect
those
basic
bot
connections?
So
what
we're
doing
in
this
case
here
I'm
going
to
be
connecting
using
app
only
I'm
going
to
be
retrieving
the
all
the
logins
from
the
audit
login
signing
endpoint
for
the
past
seven
days.
I
can
go
do
seven
days.
I
can
do
30
days
90
days,
180.
A
A
That
would
be
helpful,
so
those
are
all
the
basic
art,
authentication
sign-ins
that
happen
against
my
environment,
right,
so
very
useful
for
you
to
be
able
to
monitor
and
try
to
understand
right,
like
what's
going
to
be
at
risk
when
we
finally
get
that
deprecation
of
basic
odd
through
the
modules
are
updated,
so
they're
not
automatically
updated.
When
we
have
new
additions
to
the
graph
right,
so
we
do
have
release
cycles.
Those
are
normally
every
month
month
and
a
half
I
would
say
so.
A
It's
not
as
soon
as
an
endpoint
is
available
that
we
have
the
support
for
microsoft,
graph
all
right
and
then
the
last
one
is
running
reports.
Okay,
so
I'm
going
to
be
defining
a
type,
the
local
path
on
my
computer.
That's
demo
report
cvs!
Csv!
Sorry
and
then
what
I'm
going
to
be
doing
is
I'm
going
to
go
and
use
the
reporting
endpoint
called
mg
report
mailbox
usage
detail.
A
I'm
going
to
run
this
here.
I'll
come
back
with
an
error,
because
essentially
we
we
still
have
some
gaps
in
the
powershell
graph
sdk
when
we're
trying
to
actually
stream
data
back
to
a
file.
The
problem
in
this
case
here
is
that
I'm
trying
to
get
the
data
and
then
populate
it
inside
of
a
csv
file,
so
that
is
still
not
working.
We
are
working
on
this
with
version
2.0,
that's
going
to
come
shortly
in
the
meantime.
A
A
So
that's
all
for
demos.
I'm
quickly
browsing
through
the
chat,
so
are
all
sdk
commands
running
with
delegated
permissions,
or
essentially
it's
the
same
as
the
graph
right.
If
we
support
delegated
permissions
for
the
graph
endpoint,
we
have
it
for
for
the
powershell
command.
If
we
support
app
only
we
do
have
it
right.
So
the
the
idea
is
that
identify
what
endpoint
is
being
called
by
that
commandlet
and
then
go
in
and
you
can
go
on
the
docks
on
microsoft.com
find
information
about
that.