Generate a Comprehensive Microsoft 365 Tenant Health Summary

Manual walkthrough — Microsoft 365 admin consoles

Collecting the full health summary by hand requires visiting seven admin surfaces. Use this path when you need a one-off review and don't want to automate.

1. License utilization

1. Go to Microsoft 365 admin center → Billing → Licenses.
2. For each subscription, note Assigned vs. Total. Flag any SKU below 70% utilization as a reclamation candidate.

2. Inactive users

1. Go to Entra admin center → Users → All users.
2. Click Columns and add Last sign-in date.
3. Sort ascending by Last sign-in. Export users with last sign-in older than 90 days and Account enabled = Yes.

3. Privileged account exposure

1. Go to Entra admin center → Roles & admins → All roles.
2. Open Global Administrator and record member count. Repeat for Privileged Role Admin, Security Admin, Exchange Admin, SharePoint Admin, Application Admin, Authentication Admin.
3. Microsoft recommends ≤ 4 Global Admins.

4. Device management

1. Go to Intune admin center → Devices → All devices and record total count and compliance breakdown.
2. Go to Entra admin center → Devices → All devices. Compare counts — Entra-registered devices not present in Intune are potentially unmanaged.

5. Risky sign-ins

1. Go to Entra admin center → Protection → Identity Protection → Risky sign-ins.
2. Set filter: Detection time = Last 30 days. Export to CSV.

6. App credential expirations

1. Go to Entra admin center → Applications → App registrations → All applications.
2. For each app, open Certificates & secrets and note any credential expiring within 30–90 days.

7. Storage growth trends

1. Go to Microsoft 365 admin center → Reports → Usage → SharePoint.
2. Select Site usage, period = Last 30 days. Export the CSV and compare Storage Used over time.

8. Compile the report

Paste each section's findings into a single document. Add a Recommendations section ranking items by risk.

Estimated time: ~45 minutes for a small tenant, 2+ hours for a large one.

Graph API recipe

All seven domains can be collected with read-only Graph API calls. Use an app registration with the permissions listed above and app-only (client credentials) authentication.

1. License utilization

GET https://graph.microsoft.com/v1.0/subscribedSkus?$select=skuPartNumber,prepaidUnits,consumedUnits

For each SKU, utilization = consumedUnits / prepaidUnits.enabled.

2. Inactive users (90+ days, still enabled)

GET /v1.0/users?$filter=signInActivity/lastSignInDateTime le {iso90DaysAgo} and accountEnabled eq true&$select=id,displayName,userPrincipalName,accountEnabled,signInActivity&$top=999

Paginate via @odata.nextLink. Requires Entra ID P1+.

3. Privileged roles

GET /v1.0/directoryRoles?$expand=members($select=id,displayName,userPrincipalName)

Filter to privileged roles: Global Administrator, Privileged Role Administrator, Security Administrator, Exchange Administrator, SharePoint Administrator, Application Administrator, Authentication Administrator.

4. Device inventory

GET /v1.0/deviceManagement/managedDevices?$select=id,deviceName,userPrincipalName,operatingSystem,complianceState,lastSyncDateTime
GET /v1.0/devices?$select=id,displayName,operatingSystem,trustType,isManaged

Reconcile by Entra device ID or device name to identify registered-but-not-managed devices.

5. Risky sign-ins (last 30 days)

GET /v1.0/auditLogs/signIns?$filter=createdDateTime ge {iso30DaysAgo} and riskLevelDuringSignIn ne 'none'&$select=userDisplayName,userPrincipalName,riskLevelDuringSignIn,riskState,createdDateTime,ipAddress,location&$top=200&$orderby=createdDateTime desc

For P2 tenants, also query /v1.0/identityProtection/riskyUsers for users currently in an at-risk state.

6. App credential expirations

GET /v1.0/applications?$select=displayName,appId,keyCredentials,passwordCredentials&$top=999

Iterate each app's keyCredentials[].endDateTime and passwordCredentials[].endDateTime; flag any within 30 days.

7. Storage growth (SharePoint)

GET /v1.0/reports/getSharePointSiteUsageStorage(period='D30')
GET /v1.0/reports/getSharePointSiteUsageDetail(period='D30')

The first endpoint returns a daily storage-used time series as CSV. Compute: start MB, end MB, absolute growth, percent growth, and flag spikes > 5% day-over-day.

Response example (subscribedSkus)

{
  "value": [
    {
      "skuPartNumber": "ENTERPRISEPACK",
      "consumedUnits": 143,
      "prepaidUnits": { "enabled": 200 }
    }
  ]
}

PowerShell — Microsoft Graph SDK

The script below uses the Microsoft.Graph PowerShell SDK to collect all seven domains and produce a structured JSON report plus per-domain CSVs.

Prerequisites

• PowerShell 7+
• Install-Module Microsoft.Graph -Scope CurrentUser
• Install-Module Microsoft.Graph.Beta -Scope CurrentUser (for some Intune endpoints)
• An account (or app registration) with the Graph scopes listed in Permissions.

Approach

1. Connect with Connect-MgGraph requesting all needed scopes.
2. For each of the seven domains, call the corresponding cmdlet (Get-MgSubscribedSku, Get-MgUser, Get-MgDirectoryRole, etc.).
3. Aggregate into a single [pscustomobject] report.
4. Export to TenantHealthSummary_{yyyy-MM-dd}.json and individual CSVs per section.
5. Print a color-coded console summary with priority recommendations.

Running

.\Get-TenantHealthSummary.ps1 -OutputPath "C:\Reports" -InactiveDays 90 -RiskyDays 30 -CertWarnDays 30

The script is idempotent and read-only — it performs no writes against the tenant.