M365-003 · Script
Cloud User Lifecycle Management
Resets passwords, disables or enables accounts, revokes sessions, and updates user details in bulk; can also disable inactive accounts.
What it does
CSV mode: each row has a UserPrincipalName and an Action:
- ResetPassword: New random password, must be changed at next sign-in, sessions revoked
- Disable: Blocks sign-in and revokes sessions
- Enable: Allows sign-in again
RevokeSessions Signs the user out of all sessions
- Update: Sets any of these columns that have a value: DisplayName, Department,
JobTitle, OfficeLocation, MobilePhone, UsageLocation Inactive mode (-DisableInactiveDays): finds enabled member accounts with no sign-in for that many days (or never signed in and older than that) and disables them, except accounts in -ExcludeUsers and accounts with admin roles (reported only). Note: Microsoft Entra ID has no "unlock" action; locked-out users unlock automatically after the lockout period, or after a password reset. Preview mode (default) shows every change without making it.
Requirements
Microsoft Graph PowerShell SDK, installed by you from the PowerShell Gallery (not included). Graph application permissions: User.ReadWrite.All, AuditLog.Read.All, Directory.Read.All. Password resets also need the User Administrator role assigned to the app. Inactive mode needs Microsoft Entra ID P1 (for sign-in dates). Windows PowerShell 5.1 or PowerShell 7.
How to run it
- Run from: an admin workstation or scheduled task with the Microsoft modules installed and app sign-in configured
- This is an admin script for your Microsoft 365 tenant, not a per-device endpoint script
- User interaction: none with app-only sign-in
- Schedule: run on demand, or weekly for reports
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| Mode | Preview = show changes only (default). Apply = make the changes. | Preview, Apply | Preview |
| InputCsv | CSV with columns: UserPrincipalName, Action, and optional Update columns. | ||
| DisableInactiveDays | Find and disable accounts inactive for this many days. 0 = off (default). | 0 | |
| ExcludeUsers | UPNs never disabled by inactive mode (for example break-glass accounts). | (none) | |
| ExportPasswords | Save reset passwords to a CSV in the Reports folder. Store or delete it securely. | False | |
| TenantId | Directory (tenant) ID, for unattended app-only sign-in. | ||
| ClientId | Application (client) ID of your app registration. | ||
| CertificateThumbprint | Thumbprint of the certificate uploaded to the app registration. | ||
| UseExistingSession | Use a Microsoft Graph session you already opened with Connect-MgGraph. | False |
Exit codes
- 0 = Completed, nothing needs attention
- 1 = Completed, but some rows failed, or inactive admins need review
- 2 = Script error (see log)
Testing steps
- Run it first with the mode set to Preview on one test account or small group. Nothing is changed in that mode.
- Read the log and confirm the planned changes are what you expect.
- Run your chosen settings on the same test target and confirm the result.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Preview mode changes nothing. Disabled accounts can be enabled with the Enable action. Old passwords cannot be restored; revoked sessions only require users to sign in again.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |