Microsoft Graph connection and user lookup cheat sheet
Connect to the correct tenant and inspect directory user records.
Microsoft Graph PowerShell SDK v1.0 commands, delegated authentication.
Updated · Microsoft Graph · 7 min read
| Command | What it does |
|---|---|
Connect-MgGraph -Scopes 'User.Read.All' -ContextScope Process | Authenticate for directory reads |
Get-MgContext | Verify tenant and granted scopes |
Get-MgUser -UserId 'user@example.com' -Property Id,DisplayName,UserPrincipalName,AccountEnabled | Read a specific user |
Disconnect-MgGraph | End the Graph session |
Walkthrough
Use approved Microsoft.Graph.Authentication and Microsoft.Graph.Users modules. User.Read.All needs administrator consent; use an already authorized app and account.
Step 1: Authenticate for directory reads
Connect-MgGraph -Scopes 'User.Read.All' -ContextScope Process
Complete interactive authentication for your approved tenant. The process scope avoids persisting this session context beyond the PowerShell process. Follow your administrator’s consent process if prompted.
Step 2: Verify tenant and granted scopes
Get-MgContext
Check TenantId, Account and Scopes before running queries. Stop if the identity or tenant differs from your intended environment.
Step 3: Read a specific user
Get-MgUser -UserId 'user@example.com' -Property Id,DisplayName,UserPrincipalName,AccountEnabled
Replace the example UPN. Requesting AccountEnabled explicitly avoids relying on the default property set. An authorization error is not evidence that the account is missing.
Step 4: End the Graph session
Disconnect-MgGraph
Disconnect when the investigation is complete. Store only the minimum necessary findings; user identifiers and account states are organizational data.