sysop@hub:~/tools/script-generator$

script-generator

Fill in the fields, get a ready-to-run script. Nothing you enter leaves your browser — these are built client-side from the templates below. Review every generated script before running it against production.

offboarding script

Generates a Microsoft Graph PowerShell script to offboard one user. Pick what it should do, then copy the result.

User principal name

Block sign-in (accountEnabled = false) Revoke all refresh tokens and sessions Remove all assigned licenses Remove from all Entra ID group memberships Convert mailbox to shared (requires Exchange Online module) Hide from the global address list Add a manager as mail-forwarding target:

bulk user creation

Paste one user per line as Display Name,UPN,Password. Generates a Graph PowerShell loop that creates every account with a forced password change at next sign-in.

Usage location (required for license assignment, ISO 3166-1 alpha-2)

mailbox permission grant

Generates an Exchange Online PowerShell script granting mailbox access from one mailbox to another.

Target mailbox (the one being accessed) Grantee (who gets access)

Full Access Auto-map the mailbox in Outlook (uncheck for a manually-added mailbox) Send As Send on Behalf

conditional access policy

Builds the Graph PowerShell to create a Conditional Access policy. Test it in the simulator before deploying, and always create new policies in report-only mode first. For a whole baseline set with a lockout check, use the policy builder.

Policy name Include users / groups (object IDs, comma-separated, or leave blank for All users) Exclude users / groups (object IDs, comma-separated — always exclude at least one break-glass account) Target cloud apps (App IDs, comma-separated, or leave blank for All apps)

Require multi-factor authentication Require device to be marked compliant Block legacy authentication clients

State

tenant export for the analyzers

One read-only script that produces the two files the analyzers on this site take: your Conditional Access policies for the CA analyzer and your sign-in log for the sign-in analyzer. It changes nothing in the tenant.

days of sign-ins Conditional Access policies sign-in log

Needs PowerShell 7 and the Microsoft.Graph module. Reading sign-in logs requires an Entra ID P1 or P2 licence and a role such as Security Reader or Reports Reader. The sign-in file contains user names and IP addresses: treat it as personal data, analyse it, then delete it. This script has not been run against your tenant by us, so read it before you run it.