Elsewhere the community kept moving. Andres Bohren posted through the holiday week with module release notes, Tony followed up his book launch with practical pieces on Teams and Copilot, and Jeff Hicks used his June potluck to say goodbye to the Lonely Administrator blog.

I have had numerous serious udpateds to my PSGuerrilla module (Install-Module PSGuerrilla) - https://github.com/jimrtyler/PSGuerrilla - Any feedback would be greatly appreciated! We are now sitting at v2.38.0.

Congrats to all of the new Microsoft MVPs that were welcomed to the program this week!

Build Your Own PowerShell AI Terminal Copilot

Bart Pasmans demonstrates how to construct a custom AI terminal assistant using PowerShell and Azure OpenAI. His two script solution takes natural language requests and generates the exact commands needed alongside a built in risk assessment system to prevent accidental infrastructure damage. This approach provides a highly customizable alternative to commercial tools by letting administrators control execution safety directly from the shell.

👉 https://bartpasmans.tech/powershell-ai-terminal-copilot/

Microsoft 365 for IT Pros 2027 Edition Ships as a Four Book Bundle

Tony Redmond and the Office 365 for IT Pros team published the 2027 edition on Wednesday, and the rename to Microsoft 365 for IT Pros is only the headline change. The bundle now consists of four separate books. The main Microsoft 365 for IT Pros volume sits at just over 900 pages after being trimmed from the roughly 1,300 pages the 2026 edition carried. The 431 page Automating Microsoft 365 with PowerShell third edition that Tony launched last week is book two. The Microsoft Purview for IT Pros and Power Platform for IT Pros volumes are new standalone books built from four chapters lifted out of the main volume. The main book carries a new Managing AI and Agents chapter covering Microsoft 365 Copilot, Agent 365, and Work IQ. If you subscribed to the 2026 edition, the renewal code landed in your inbox on Wednesday morning.

👉 https://office365itpros.com/2026/07/01/microsoft-365-for-it-pros/

Jeff Hicks June Potluck Marks the End of The Lonely Administrator

Jeff Hicks used his June potluck for the news on the SecretManagement archive and the Summit 2027 CFP opening, plus a run through the PSReadline CopyScreen key handler that lets you select terminal output with the shift arrow keys and copy it to the clipboard on Enter. He also drops a recommendation for The Microsoft DSC Handbook on Leanpub covering DSC v3, announces his return to SpiceWorld in Austin on November 12 and 13, and closes with the news that he is deprecating his long running WordPress blog The Lonely Administrator later this year. If you have posts from there you have relied on over the years, grab them now while they are still online. The scripting challenge this month is a VHD backup tool that pushes on both PowerShell and storage fundamentals.

👉 https://buttondown.com/behind-the-powershell-pipeline/archive/

Andres Bohren Ran the Module Release Board All Week

Andres Bohren kept his usual pace through the holiday week and shipped four module release notes worth pulling. Microsoft published a new version of the MicrosoftPlaces PowerShell module on both June 30 and July 3, so you probably want the July 3 build if you have not updated recently. Microsoft.Online.SharePoint.PowerShell 16.0.27424.12000 landed on June 30 with the usual mix of authentication and provisioning refinements. Microsoft shipped a new PowerToys build this week that Andres notes on July 3 for anyone running the utility suite. And Git ticked up to 2.55.0 on July 1, which Andres covers with his usual install walkthrough using winget. If you follow one blog for Microsoft module release notes, Andres is still the one to read.

👉 https://blog.icewolf.ch/

Teaching Tara: PowerShell Script Breakdown

Andrew Pla and Tara Sinquefield sit down together and read through scripts as a team. Tara asks the beginner questions the rest of us stopped asking a long time ago, and Andrew explains variables, param blocks, sub expressions, calculated properties, and the pipeline at the pace of someone just starting to learn. If you have anyone on your team who is trying to pick up PowerShell, this is the episode to send them. Bonus AI discussion at the end on where Claude and ChatGPT actually help learners versus lead them into bad habits.

Morten Mynster Kristensen Spots New Graph Beta Permissions for Creating Defender Alerts

Fellow PowerShell MVP and LeastPrivilegedMSGraph author Morten Mynster Kristensen flagged this week that Microsoft quietly landed two new Beta permissions on Microsoft Graph, SecurityAlert.Create.All in both delegated and application forms. The endpoint at /security/alerts_v2 now accepts POST, which means you can create your own alerts in Microsoft Defender XDR from PowerShell rather than only reading them. For anyone who has built detection logic in a script and had to route the output to email, a Teams webhook, or a Sentinel ingestion pipeline, the ability to write directly into the Defender queue is a meaningful architectural shift. I plan to get support for this into my PSGuerrilla module.

👉 https://www.linkedin.com/posts/mortenmynster_powershell-msgraph-automation-activity-7345854938947694593

Tony Redmond on the Small Window for Incoming Teams Calls

Tony Redmond writes that a recent Microsoft Teams improvement is buried deep enough in settings that most users will never find it. Incoming Teams calls can now be answered in a small window rather than the full application view, and for people who take a lot of calls the difference is real. You can keep working in your primary application while the call runs in a small overlay rather than losing your context every time somebody rings. Tony’s frustration with the discoverability of the feature is fair. If you are a busy person on Teams, this is worth changing this weekend so it is on the next time you need it.

👉 https://office365itpros.com/2026/06/30/teams-small-window/

PowerShell with Buttons

Andrew Pla and Stephen Valdinger at PSConfEU 2026 The PSConfEU 2026 session recording landed this week and it is a full ninety minute hands on walkthrough of PowerShell Universal from the two of them. Stephen Valdinger from Chocolatey Software leads the technical demo, Andrew Pla plays the perfect stand in for anyone getting reintroduced to PSU after a break, and the pair walk through turning a real PowerShell module into a full web application with a REST API layer, a SQLite back end, forms, dashboards, Pester unit tests, PSPlayright UI tests, and a new plaster template that scaffolds a full PSU app module for you in one command. This is the practical content that sends you straight to Adam Driscoll’s docs Sunday afternoon.

Windows 11 26H2 Prep Time Starts Now

Microsoft published the initial 26H2 announcement in late June and the message from the community is start testing. Jason Leznek’s Windows IT Pro Blog piece covers the upgrade paths, the Autopatch pilot to production strategy, and the tracking mechanisms available to walk your fleet through a controlled rollout. For K12 shops with student devices in the field, summer is the window to get the pilot ring stood up before the school year starts. The changes are not disruptive on the surface but the Autopatch story continues to mature and the discipline of running the pilot correctly compounds over years.

👉 https://techcommunity.microsoft.com/t5/windows-it-pro-blog/get-ready-for-windows-11-version-26h2/ba-p/4529367

Encore: Lessons in Leadership from PowerShell Pioneers Jeffrey Snover and Don Jones

The encore of the April 28, 2025 conversation recorded live at the PowerShell + DevOps Global Summit dropped fresh this week. Snover walks through the origin story of PowerShell and the pivotal moment his path crossed with Don’s, Don brings his usual thoughtful reflection on the shift from individual contributor to leader, and the throughline is that vulnerability, repetition, and kindness are core to any real career.

PSConfEU 2026 Session Archive

The rest of the PSConfEU 2026 sessions from Wiesbaden continue to upload on the SynEdgy channel through the summer. I shared Andrew’s above, but I could frankly load the newsletter if I wanted to. Deep technical content across PowerShell, DSC, PSU, security, and community sessions from the tenth anniversary edition of the conference.

👉 https://www.youtube.com/@synedgy

Events

Midwest Tech Talk 2026 | July 19 to 21, 2026 | Lake of the Ozarks, Missouri I am speaking at this one in just over two weeks. Kickoff event Sunday July 19, main conference Monday and Tuesday at The Resort at Lake of the Ozarks, with an evening event Monday hosted by Provision Data Solutions. Two day K12 technology and security symposium built by folks who actually run school district tech departments, doubling as the K12TechPro Regional Meetup for the Midwest. If you are in K12 IT anywhere in the region, this is the one to make this summer.

👉 https://www.midwesttechtalk.com/

MMS Midway | October 25 to 28, 2026 | San Diego, California The classic endpoint management and PowerShell conference moves to San Diego this fall. Strong K12 IT representation if you are looking for peers in that space.

👉 https://mmsmoa.com/

SpiceWorld 2026 | November 12 to 13, 2026 | Austin, Texas Jeff Hicks is returning to Austin this fall to talk PowerShell at the annual Spiceworks community event. The pricing is genuinely reasonable for the caliber of content, and if you have a hybrid IT day job the tracks tend to hit the practical stuff you can use Monday morning.

👉 https://www.spiceworks.com/spiceworld/

Zero Trust World 2027 | February 17 to 19, 2027 | Orlando, Florida ThreatLocker’s seventh annual cybersecurity training event lands at Rosen Shingle Creek in Orlando. Three days of hands on training, real attack technique walkthroughs, hacking labs, and Cyber Hero Certification exam sessions every morning. If you defend an environment for a living, this one is built for you.

👉 https://ztw.com/

PowerShell + DevOps Global Summit 2027 | April 5 to 8, 2027 | Orlando, Florida The flagship US PowerShell event moves to the Sheraton Lake Buena Vista in Orlando. Call for papers opened Wednesday and runs through the summer, and early bird registration is open now. The OnRamp program for newcomers runs alongside the main track.

👉 https://powershellsummit.org/

PSConfEU 2027 | Dates and location to be announced SynEdgy is organizing the eleventh edition of PowerShell Conference Europe after this year’s tenth anniversary run in Wiesbaden. Watch psconf.eu for the announcement, which typically lands toward the end of summer.

👉 https://psconf.eu/

Fellow PowerShell MVP Jorge Suarez of IntuneHydrationKit fame shipped Tenant Graph, a free open source web app that renders Intune and Entra ID assignments as an interactive Three.js topology. Sign in with Microsoft Entra to search across users, devices, groups, apps, policies, and Conditional Access, with a Readable Mode that explains relationships in plain language and an admin impact panel for blast radius. The sample tenant at tenantgraph.com lands you in a Lumon themed demo with no auth required, so you can poke around before granting delegated Graph scopes against production.
👉https://github.com/jorgeasaurus/TenantGraph

Three big demos from the June PowerShell Community Call

Jason Helmick called the June PowerShell Community Call the summer edition, and what showed up was about as loaded a single hour as the call has run in a while. The PSConfEU recap took a few minutes. The servicing updates and a real warning about Azure AD Graph traffic took a few more. The Az PowerShell team showed off a login flow improvement that quietly fixes a problem every enterprise administrator has hit. And then three demos landed back to back to back, each of which would have been a headline in any other month. If you only have time to watch one segment of the recording, watch the demos. If you have time for the whole thing, the housekeeping is genuinely worth it this time.

Microsoft Ships DSC 3.3.0-preview.3 with New Windows Resources and Server Mode

Steve Lee dropped DSC 3.3.0-preview.3 on Wednesday with a handful of changes worth your attention. The build adds a Microsoft.Windows/WindowsFeatureList resource from Gijs Reijn for managing optional Windows features through DSC, plus a new Registry Adapter and Microsoft.Windows/Personalization resource that lets you target the registry for personalization configuration without writing a custom resource. Steve also renamed the previous MCP mode to Server mode, which is a cleaner name now that the protocol has settled into the broader tooling ecosystem. PSAdapter got two notable fixes from Steve, one for stream event tracing and one for modules with ScriptsToProcess that used to break. If you are testing DSC v3 in production, this is the preview to pull this weekend.

👉https://github.com/PowerShell/DSC/releases/tag/v3.3.0-preview.3

Andrew Pla and Leo D’Arcy Make the Case for Code Signing in CI/CD

My good friend Andrew Pla sat down with UK based cloud solutions architect Leo D’Arcy on The PowerShell Podcast for a candid conversation on Active Directory Certificate Services, code signing, and why so many organizations get PKI spectacularly wrong. The practical takeaway is the argument for adding a code signing step to your CI/CD pipeline as a scalable alternative to constrained language mode, which gives you cryptographic proof that scripts have not been tampered with without giving up flexibility. Leo runs the Remote Access User Group community on Discord and is a repeat PSConfEU speaker, so the conversation also ranges into the developer mindset taking over IT and why being able to talk networking with network engineers and business outcomes with leadership is the real career multiplier.

Automating Microsoft 365 with PowerShell 3rd Edition Ships

Tony Redmond and the Office 365 for IT Pros team published the third edition of Automating Microsoft 365 with PowerShell on Tuesday. The new edition runs 431 pages across eight chapters and is available now in EPUB and PDF from Gumroad, with the paperback landing on Amazon July 1. Coverage spans the base Microsoft 365 workloads, the Graph PowerShell SDK, Entra ID administration, workload automation, and the management APIs for sign in logs and audit data. The book comes bundled with the Microsoft 365 for IT Pros 2027 edition that also drops July 1, and current subscribers have already received the renewal code. If you write PowerShell for Microsoft 365 every day, this is the one to have on your desk.

👉 https://office365itpros.com/2026/06/23/automating-microsoft-365-3rd/

Microsoft Graph SDK V2.38 and Exchange Online Module Refuse to Get Along

Tony Redmond writes that the newest Microsoft Graph PowerShell SDK at V2.38 and the latest Exchange Online Management module are not playing nicely together, and the situation is getting worse rather than better. Loading both into the same session leads to assembly version conflicts that break authentication or cmdlet behavior in ways that are not always obvious until your script halts mid run. Tony goes through the workarounds, including running the two modules in separate sessions, and uses the post to highlight two cmdlets he discovered along the way that most administrators have probably never used. Worth a read before you trust a hybrid script in production.

👉 https://office365itpros.com/2026/06/22/powershell-woes-and-cmdlets/

Find Inactive Teams Channels with Graph PowerShell

Tenants accumulate inactive Teams channels the same way garages accumulate cardboard. Tony Redmond walks through a PowerShell approach for finding channels that nobody has touched in months using the Microsoft Graph PowerShell SDK. The script pulls channel metadata, checks the last activity date, and gives you a sorted list of candidates to either archive or remove. What you do with the output is your call, but having a defensible list before the next governance review is a good start. Pair this with Tony’s deleted Teams chat threads piece from last week for a fuller Teams hygiene toolkit.

👉 https://office365itpros.com/2026/06/24/find-inactive-channels/

Andres Bohren Ships M365 Service Monitor PowerShell 1.7

Andres Bohren updated his M365 Service Monitor script to version 1.7 this week with two practical fixes worth picking up. The June 17 patch fixed the modern HTML rendering for Outlook classic, which was breaking the dashboard for anyone still on the legacy client. The June 14 patch fixed path issues that tripped scheduled runs and added the date to the HTML output so you can see at a glance when the report last ran. The script polls the Service Communications API and produces a clean status dashboard you can drop into a SharePoint page or email out on a schedule. The GitHub repo has the full update notes and the latest module.

👉 https://blog.icewolf.ch/archive/2026/06/24/basic-M365-monitoring-with-powershell-1-7/

What Do You Really Get with Intune Suite in E3 and E5

Andrew Taylor wrote the Intune Suite breakdown you want to read before July 1. Starting next Wednesday, Intune Suite features fold into Microsoft 365 E3 and E5 instead of requiring a separate add on, and Andrew walks through what each component does and how much of it you will actually use. He covers Endpoint Privilege Management, Remote Help with unattended access, Advanced Analytics with Device Query and Multi Device Query, Microsoft Tunnel for mobile app access to on premise resources, and Cloud PKI. If you have been paying for the Intune Suite add on separately, you may be about to free up budget. If you have not, you may be about to get capabilities you did not know you had.

👉 https://andrewstaylor.com/2026/06/24/what-do-i-really-get-with-intune-suite/

Events

Midwest Tech Talk 2026 | July 19 to 21, 2026 | Lake of the Ozarks, Missouri I am speaking at this one. Kickoff event Sunday July 19, main conference Monday and Tuesday at The Resort at Lake of the Ozarks, with an evening event Monday hosted by Provision Data Solutions. Two day K12 technology and security symposium built by folks who actually run school district tech departments, doubling as the K12TechPro Regional Meetup for the Midwest. If you are in K12 IT anywhere in the region, this is the one to make this summer.

https://www.midwesttechtalk.com/

MMS Midway | October 25 to 28, 2026 | San Diego, California The classic endpoint management and PowerShell conference moves to San Diego this fall. Strong K12 IT representation if you are looking for peers in that space.

https://mmsmoa.com/

Zero Trust World 2027 | February 17 to 19, 2027 | Orlando, Florida ThreatLocker’s seventh annual cybersecurity training event lands in Orlando. Three days of hands on training, real attack technique walkthroughs, hacking labs, and Cyber Hero Certification exam sessions every morning. It was a blast this year - I’d recommend you check it out. It’s not very expensive.

https://ztw.com/

PowerShell + DevOps Global Summit 2027 | April 26 to 29, 2027 | Bellevue, Washington The flagship US PowerShell event. Registration tends to fill early, and the call for speakers usually opens in late summer if you are thinking about submitting.

https://powershellsummit.org/

PSConfEU 2027 | Dates and location to be announced SynEdgy is organizing the eleventh edition of PowerShell Conference Europe after this year’s tenth anniversary run in Wiesbaden. Watch psconf.eu for the announcement, which typically lands toward the end of summer.

https://psconf.eu/

Install-Module PSGuerrilla

Then, you can now launch the GUI with

Show-Guerrilla

And get a nice fancy report like this one, though hopefully not this failed :)

Videos, Videos, Videos!!!

The PowerShell Global DevOps Summit videos are now LIVE! They began dropping videos earlier this week. Here is the entire playlist.

The Same for PSConfEU! Everything is live on here on this playlist:

How Much Will July 2026 License Increases Cost Your Tenant

July 1, 2026, is the day Microsoft starts charging tenants more for nearly every license in the M365 catalog. Tony Redmond serves up a PowerShell script that retrieves the licenses assigned across your users, applies the published increase rates for each affected product, and returns the real monthly impact for your tenant. The increase rates vary by SKU and the script handles the variation cleanly. If you have not already had this conversation with your finance team, this is the read for this weekend. Pair it with last week’s piece on stale accounts and you have a complete pre July audit kit.

https://office365itpros.com/2026/06/16/monthly-license-increase-july-2026/

PowerShell 7.6.3 Released as Current LTS

Microsoft shipped PowerShell 7.6.3 on Tuesday and Andres Bohren has the install walkthrough on his blog. The build sits on the .NET 10.0.9 runtime, and the headline shift for Mac shops is that the macOS PKG package is now notarized and signed by Microsoft, closing a long standing gap for production deployments on Apple silicon. 7.6.3 is the current LTS, while the previous LTS at 7.4.17 still has support through November 10, 2026, so the upgrade can be planned rather than scrambled. Worth dropping into your test ring this weekend.

https://blog.icewolf.ch/archive/2026/06/16/powershell-7-6-3-released/

Microsoft.Graph PowerShell SDK 2.38.0 Ships

Same Tuesday, Microsoft also pushed version 2.38.0 of both the Microsoft.Graph and Microsoft.Graph.Beta modules to the PowerShell Gallery. Andres notes that Microsoft did not publish release notes for this one, but the comparing changes view on GitHub fills the gap if you want to know exactly what shifted between 2.37 and 2.38. Andres continues to install through PSResourceGet with the Microsoft Artifact Registry rather than the older PowerShellGet workflow, which mirrors where Microsoft is steering everyone for first party module installation. If you have not switched over yet, this is the release to do it on. https://blog.icewolf.ch/archive/2026/06/16/microsoft-graph-powershell-modules-2-38-0-released/

Microsoft Tightens Self Service Password Reset in September

Tony Redmond writes that Microsoft is closing a soft spot in Self Service Password Reset starting September 6, 2026. Today, SSPR can fall back on directory attributes to verify a user, which is a risk because those attributes can be modified by an attacker who has already compromised an account. The new behavior requires every user to register at least one authentication method through their Security Info page, and SSPR verifies identity only through that registered method. Microsoft kicks off a registration campaign on July 6 to push users and administrators to register before enforcement. Get your registration reporting in place now so the campaign does not surprise you.

https://office365itpros.com/2026/06/17/sspr-authentication-methods/

Removing Problematic Teams Chat Threads with Graph PowerShell

Sometimes a user posts something to Teams that has to come down, and the standard admin experience does not make that easy. Tony Redmond walks through the Microsoft Graph PowerShell SDK cmdlets to find chat threads, scan thread messages for the targeted content, and remove the offending threads. The script can run interactively for one off cleanup, or get wrapped into a tenant maintenance routine if this is something you handle regularly. If you have ever scrambled to pull a bad chat thread out of Teams in the middle of an incident, this one is worth a bookmark. https://office365itpros.com/2026/06/15/delete-teams-chat-threads/

Andres Bohren Marks 3000 Blog Posts

Andres Bohren hit a milestone this week with his 3000th blog post, written 19 years after his first post in November 2007. He calculated the average using New TimeSpan in PowerShell, naturally, and worked out that he has published a blog post roughly every other day for almost two decades. The archive spans Exchange, Outlook, ESX, SQL, Active Directory, and of course PowerShell, and the consistency is what got him recognized as a Microsoft MVP. If you want a single example of what consistent community contribution looks like over a career, his archive is the model.

https://blog.icewolf.ch/archive/2026/06/18/celebrating-3000-blog-articles/

PowerShell Universal, Community, and the Magic of Showing Up with Adriano Carollo

My good friend Andrew Pla and Berlin sysadmin Adriano Carollo on city swings then over dinner at PSConfEU 2026. Adriano covers how PowerShell Universal pulled him into web app territory through React and JavaScript, why he built an open source personal assistant in PowerShell, and what it took to pay his own way to the conference after Andrew's podcast convinced him to show up. Andrew shares his own origin story for the first time on the show.

Microsoft Artifact Registry Hits Its Stride with the 2.38 Release

The Microsoft.Graph 2.38 release this week is another data point in the steady migration that Microsoft is running to shift first party PowerShell modules from the community PowerShell Gallery to the Microsoft Artifact Registry. Andres Bohren installs every Microsoft module through MAR using PSResourceGet, and his M365PSProfile module wraps the workflow if you want a turnkey way to keep your tenant tools current. The pitch is straightforward. MAR is a Microsoft controlled feed with stronger provenance and ownership guarantees than the community gallery, which has had its share of compromised module incidents. If your environment still pulls Microsoft modules from PSGallery by default, this is the year to swap.

https://blog.icewolf.ch/archive/2026/06/16/microsoft-graph-powershell-modules-2-38-0-released/

Events

Midwest Tech Talk 2026 | July 19 to 21, 2026 | Lake of the Ozarks, Missouri I am speaking at this one. Kickoff event Sunday July 19, main conference Monday and Tuesday at The Resort at Lake of the Ozarks, with an evening event Monday hosted by Provision Data Solutions. Two day K12 technology and security symposium built by folks who actually run school district tech departments, doubling as the K12TechPro Regional Meetup for the Midwest. If you are in K12 IT anywhere in the region, this is the one to make this summer.

https://www.midwesttechtalk.com/

MMS Midway | October 25 to 28, 2026 | San Diego, California The classic endpoint management and PowerShell conference moves to San Diego this fall. Strong K12 IT representation if you are looking for peers in that space.

https://mmsmoa.com/

Zero Trust World 2027 | February 17 to 19, 2027 | Orlando, Florida ThreatLocker’s seventh annual cybersecurity training event lands in Orlando. Three days of hands on training, real attack technique walkthroughs, hacking labs, and Cyber Hero Certification exam sessions every morning. It was a blast this year - I’d recommend you check it out. It’s not very expensive.

https://ztw.com/

PowerShell + DevOps Global Summit 2027 | April 26 to 29, 2027 | Bellevue, Washington The flagship US PowerShell event. Registration tends to fill early, and the call for speakers usually opens in late summer if you are thinking about submitting.

https://powershellsummit.org/

PSConfEU 2027 | Dates and location to be announced SynEdgy is organizing the eleventh edition of PowerShell Conference Europe after this year’s tenth anniversary run in Wiesbaden. Watch psconf.eu for the announcement, which typically lands toward the end of summer.

https://psconf.eu/

Mastering PowerShell Parameters with Jeff Hicks at PowerShell + DevOps Global Summit 2026

Jeff Hicks delivered a session packed with demos on advanced parameter design at this year’s PowerShell + DevOps Global Summit in Bellevue, and Confreaks has the recording up on YouTube. He walks through advanced validation methods, leveraging types for greater efficiency, dynamic parameters, experimental features, and the techniques introduced in PowerShell 7 that make your function parameters do real work. If you write functions you ship to other people, this is the kind of session worth a weekend hour.

Microsoft to Delete Unlicensed OneDrive for Business Accounts

Tony Redmond at Office 365 for IT Pros wrote up Microsoft’s decision to start deleting unlicensed OneDrive for Business accounts that have not been paid to be archived, with the change taking effect after July 2026. Up until now those accounts could linger in Microsoft 365 Archive until retention policies and holds expired, but going forward tenants will have to decide which accounts to keep and pay for, and the rest will be removed regardless of retention or eDiscovery holds. This is a meaningful policy shift that anyone with messy offboarding hygiene needs to read before next month rolls around.

https://office365itpros.com/2026/06/12/unlicensed-onedrive-for-business-2/

Cookie Monsters and Defender Live Response with Miriam Wiesner on The PowerShell Podcast

My good friend, Andrew Pla, sat down with Miriam Wiesner at PSConfEU 2026 in Wiesbaden for a wide ranging conversation on cookie theft attacks, Defender live response, and the state of PowerShell security. Miriam, a security research PM at Microsoft working on Defender and Sentinel research, walked through her Return of the Cookie Monsters session where she demonstrated extracting Teams cookies to hijack chats, SharePoint sites, and OneDrive content from a single compromised endpoint. She also recapped the live response session she delivered with Stefan Fanulik on using Defender to investigate and remediate compromised devices without enabling RDP or PowerShell remoting. The conversation closes with a frank discussion of why PowerShell security features make life harder for sophisticated threat actors and why visibility through script block logging matters more than ever.

Adam Driscoll Recaps PSConfEU 2026 and Demos PowerShell Universal AI Tooling

Adam Driscoll posted his PSConfEU 2026 recap over at the Devolutions blog, sharing both the personal experience and the technical headline from his two sessions at the conference. The news from his sessions is PowerShell Universal 2026.2 with new AI tooling focused on MCP tools and agents, where Adam demonstrated building modules, APIs, and web apps using GitHub Copilot connected directly to a PowerShell Universal instance and generating real solutions from simple prompts. Devolutions stepped up as the key sponsor of the conference this year, and the recap is worth a read if you want to understand what has shipped in PowerShell Universal since the acquisition.

https://devolutions.net/blog/psconfeu-celebrating-ten-years-of-powershell-community/

Setting Up Least Privileged MS Graph on PowerShell Wednesday with Morten Mynster and Jake Hildreth

Andrew Pla hosted Morten Mynster and Jake Hildreth on PowerShell Wednesday this week for a walkthrough of the prerequisites to use Morten’s Least Privileged MS Graph module, the open source tool Morten built for auditing and reducing permission exposure across Microsoft Graph applications. Jake plays the friendly guinea pig live on his own tenant while Morten walks him through creating the Azure resource group, log analytics workspace, diagnostic settings for Microsoft Graph Activity Logs, the app registration, and the right API permissions. The session ran as part one of two, with next week’s installment digging into what the module actually reports once the logs roll in.

Tony Redmond Primers Sensitivity Labels with PowerShell

Tony Redmond put together a primer on the three different cmdlets available for fetching sensitivity labels with PowerShell, one in the Exchange Online module and two powered by Graph APIs. The differences come down to scope, properties returned, and whether you get the full set of available labels or just a slice. Worth bookmarking if you have ever stared at the output of one of these cmdlets and wondered why it does not match what you see in the Purview admin center.

https://office365itpros.com/2026/06/11/sensitivity-label-ps/

PowerToys v0.100.0 Released

Andres Bohren over at Icewolf marked the release of PowerToys v0.100.0, the round number milestone version of Microsoft’s open source utility suite for Windows power users. Andres includes his usual install walkthrough using winget along with notes on where to find the release artifacts on GitHub. If PowerToys has earned a spot on your daily driver, this is the version to install this weekend.

https://blog.icewolf.ch/archive/2026/06/11/powertoys-v0-100-0-released/

ExchangeOnlineManagement PowerShell Module 3.10.0 Released

Andres Bohren also covered Microsoft pushing version 3.10.0 of the ExchangeOnlineManagement PowerShell module to the gallery. The headline change is that the minimum required version of PowerShell 7 is now 7.6, while Windows PowerShell 5.1 remains unaffected. The release also fixes an issue where certificate authentication failed in Connect-IPPSSession when using the EnableSearchOnlySession switch, which is worth knowing if you script against Exchange Online in production.

https://blog.icewolf.ch/archive/2026/06/10/exchangeonlinemanagement-3-10-0-released/

PDQ Breaks Down June 2026 Patch Tuesday

The PDQ team is back with their monthly Patch Tuesday recap, and June is one of the larger releases in recent memory. Microsoft published patches for roughly 200 vulnerabilities including three actively exploited zero days, with critical remote code execution issues in core Windows infrastructure components and elevation of privilege bugs across the stack. If you handle patching for your fleet, this is your reading material before you start deploying.

https://www.pdq.com/blog/patch-tuesday-june-2026/

Tony Redmond on Finding Inactive User Accounts

Tony Redmond covers how to find inactive user accounts in Microsoft 365 tenants, with extra urgency given the Microsoft 365 license price increases coming into effect on July 1, 2026. He walks through two approaches: the Microsoft 365 Licensing Report for a quick view, and a PowerShell script that assesses inactivity based on sign in dates and refresh token baselines for more nuanced results. The point is that inactive accounts soak up licenses that suddenly cost more, and there has never been a better time to clean house.

https://office365itpros.com/2026/06/09/find-inactive-accounts/

Exchange Server SE Cumulative Update SU7 Available

Andres Bohren ran through Microsoft’s release of the SU7 update for Exchange Server Subscription Edition, including the post installation reboot requirement and his usual reminder to check for pending reboots before kicking off the installer. The KB number is 5094139 and the security update is available for direct download from Microsoft. For shops still running Exchange on premise or in a hybrid configuration, this is on the list of things to schedule for the next maintenance window.

https://blog.icewolf.ch/archive/2026/06/09/exchange-server-SE-SU7-has-been-released/

Andres Bohren Checks Azure VM Extension Versions

Andres Bohren circled back to his earlier Icewolf article on activating VM Automatic Extension Upgrade and added some practical guidance on checking the current extension version on running Azure VMs. The walkthrough uses PowerShell to inspect what version is deployed and confirms whether the automatic upgrade has run. Useful if you manage a fleet of Azure VMs and want to make sure they are not falling behind on agent and extension updates.

https://blog.icewolf.ch/archive/2026/06/08/check-azure-vm-extension-version/

Andrew Taylor’s Intune Newsletter Lands from Experts Live UK

Andrew Taylor published this week’s Intune Newsletter live from Experts Live UK in London, with content put together between trains, hotel rooms, and conference rooms. Highlights include a guide from Andrei Shchetkin on converting any Azure VM into a Windows 365 image using only Graph commands, and a script from T-Bone on modern drive and printer mapping for cloud native Windows with Intune and PowerShell. The full newsletter is worth your time if you manage endpoints.

https://andrewstaylor.com/2026/06/12/intune-newsletter-12th-june-2026/

PSConfEU Session Recordings

PSConfEU session recordings are starting to land on the SynEdgy YouTube channel following the conference wrap in Wiesbaden, and the 2026 lineup includes deep technical sessions from Steven Bucher on the state of the shell, Thorsten Butz on AI in PowerShell workflows, and Adam Driscoll on what is new in PowerShell Universal 2026.2. Sessions get uploaded over the coming weeks, so subscribing keeps you current.

Slides, scripts, and session materials from PSConfEU 2026 are collected at the conference GitHub repository, where speakers continue to drop their decks and demo code through June. This is the companion resource to the YouTube recordings.

https://github.com/psconfeu/2026

Upcoming Events

Experts Live UK wraps up today in London after two full days of sessions across Microsoft 365, Azure, AI, security, and the modern workplace. Recordings and recap content typically land in the weeks following the event from attendees and speakers, so keep an eye on the schedule page and social posts from the Intune and SCCM crowd.

https://eluk26.expertslive.co.uk/

The PowerShell + DevOps Global Summit returns to Bellevue, Washington in April 2027, the premier community event hosted by The DevOps Collective. Early bird registration usually opens late summer, so worth bookmarking now if you are planning ahead.

https://powershellsummit.org/

Looking further out, MMS Midway Edition heads to San Diego October 25 through 28, the smaller West Coast sibling of the main Midwest Management Summit.

https://mmsmoa.com/

Build returned outside Seattle for the first time since 2016, with Satya Nadella opening at Fort Mason on Tuesday morning to about 2,500 developers in the room. The framing this year was AI agents finally maturing from demo to deployment, and the announcement list reflects that shift. GitHub Copilot now has a native desktop app with agentic workflows in preview, Project Rayfin offers a managed backend on Microsoft Fabric using workflows defined in GitHub, the Surface RTX Spark Dev Box puts one petaflop of compute and 128 gigabytes of unified memory on a developer’s desk for running 120 billion parameter models locally, and Microsoft introduced seven new MAI models including MAI-Thinking-1 for reasoning and MAI-Code-1 tuned for GitHub and VS Code. Foundry Local reached general availability, Azure AI Foundry can now route across models per task, Agent 365 expanded its enterprise governance footprint, and GPT-5.5 arrived with Tier 5 and 6 quota. A lot to digest.

https://build.microsoft.com/

PowerShell Conference Europe 2026 Wraps Up in Wiesbaden

The tenth edition of PSConfEU ran June 1 through June 4 at the Dorint Pallas Hotel in Wiesbaden, drawing more than 300 attendees, around 40 speakers, and roughly 70 sessions across four packed days. SynEdgy pulled off another solid year with deep technical content from the usual heavyweights, the return of PoshaKucha at twenty slides by twenty seconds each, and the Monday bike tour winding 30 kilometers along the Rhine to Eltville. Steven Bucher delivered three sessions including State of the Shell, Thorsten Butz took the stage with another fresh AI talk, and the broader Devolutions team showcased work on PowerShell Universal that included the first public demo of their AI integration since acquiring the platform. Ten years in, the community still feels like the heart of why this event matters.

https://psconf.eu/

Argument Completers, Dynamic Parameters, and More from Ben Reader at PSConfEU 2026

Ben Reader, the pipeline daddy at Patch My PC, walked through how to build better PowerShell functions in his PSConfEU 2026 session, framed around a database access problem that he kept needing to extend across four revisions of the same script. He starts with the basics that most of us already use like validate set, validate range, and validate pattern, then moves into the more advanced ground of custom validate classes, registered argument completers, inline completers, dynamic parameters, and finally his preferred approach of building completers as their own .NET classes that the function parameter references through a clean attribute. The walkthrough is the kind of thing you can drop right into your next module, and the recording landed alongside the rest of the PSConfEU 2026 sessions this week.

Devolutions Brings AI to PowerShell Universal at PSConfEU

Adam Driscoll took the stage at PSConfEU to walk through what has shipped in PowerShell Universal since the Devolutions acquisition, and the headline was the first public demonstration of AI capabilities integrated into the platform. Marc-André Moreau followed with a separate session on implementing PSRemoting at Devolutions covering PowerShell SDK limitations, WinRM quirks, TrustedHosts behavior, and the practical realities of NTLM and Kerberos authentication in production software. The booth ran live demos throughout the conference, and if you missed Adam’s session in person it should land in the public recording archive in the coming weeks.

https://devolutions.net/blog/devolutions-at-psconf-eu-2026-unveiling-ai-in-powershell-universal-in-wiesbaden/

Foundry Local Reaches General Availability at Build

Among the busy slate of Build announcements, Foundry Local stepping into general availability stood out for anyone running model inference closer to the user. The runtime now ships as a supported product rather than a preview, and pairs naturally with the new Surface RTX Spark Dev Box for developers who want to actually run models that previously had to live in the cloud. Together with the seven new MAI models and Azure AI Foundry’s new ability to route across models, the story Microsoft is telling is one of choice across local and cloud and across providers, which is a welcome shift.

https://www.tomsguide.com/news/live/microsoft-build-2026

Tony Redmond on Container Management Labels for Security Groups

Tony Redmond walks through Microsoft’s new preview that brings container management labels to Entra ID security groups. The scope is currently narrow with just one control available, the AllowToAddGuests setting that determines whether guest accounts can be members. Tony makes the case that even this single lever is meaningful because guest access to sensitive security groups has long been a quiet risk that nobody had a clean way to prevent.

https://office365itpros.com/2026/06/03/security-groups-labels/

Tracking Distribution List Changes with PowerShell

A reader question about reporting distribution list changes prompted Tony Redmond to walk through how to do it properly given that distribution lists are Exchange Online objects rather than Entra ID groups. The same general PowerShell structure used for Microsoft 365 group change reporting applies, but the audit records and the actual code look quite different. Worth a read if you have ever opened a ticket asking who removed a manager from a critical list.

https://office365itpros.com/2026/06/02/distribution-list-changes/

MicrosoftPlaces PowerShell Module Hits 2.1.9

Andres Bohren posted at Icewolf about Microsoft pushing version 2.1.9 of the MicrosoftPlaces PowerShell module to the gallery. The release notes are thin since 2.1.8, but the headline is that the Object reference not set to an instance of an Object error that plagued 2.1.7 and 2.1.8 has been fixed. If you skipped the last two releases for that reason, this is the version to install.

https://blog.icewolf.ch/archive/2026/06/02/microsoftplaces-powershell-module-2-1-9-has-been-released/

What’s New in Microsoft Entra June 2026

The Entra team published their June roundup with a handful of items that admins will want to track. Passkey policies now get their own dedicated 20 kilobyte allocation in the authentication methods policy rather than sharing a single bucket with everything else, and the maximum number of passkey profiles per tenant goes from three to ten. There is also a reminder that the MFA enforcement for passwordless credential registration completes rollout by July 13, 2026, so if you have not finished your conditional access work for that, the clock is real.

https://techcommunity.microsoft.com/blog/microsoft-entra-blog/whats-new-in-microsoft-entra-june-2026/4517885

Handling Loop Workspaces for Departed Users

Tony Redmond covers Microsoft finally rolling out a workflow to deal with personal Loop workspaces left behind when employees leave a tenant. The process is unfortunately manual with limited automation possible, but at least the framework now exists to review and preserve workspace content rather than losing it. Two years from announcement to rollout is not fast, but it is finally here.

https://office365itpros.com/2026/06/04/user-owned-loop-workspaces/

Office 365 for IT Pros June 2026 Update and 2027 Plans

The 132nd monthly update for the Office 365 for IT Pros eBook is now available for subscribers, and Tony Redmond used the post to share what is coming for the 2027 edition. The book is being renamed, a new chapter on Copilot and agents is being added, and two topics are being split out into their own books covering Microsoft Purview and the Power Platform. If you have been wondering when the ecosystem would finally outgrow a single volume, the answer is now.

https://office365itpros.com/2026/06/01/office-365-for-it-pros-132/

Upcoming Events

Experts Live UK (formerly Workplace Ninjas UK, rebranded for 2026) June 11-12, 2026 at CodeNode, London. That’s next week, not late summer.

https://eluk26.expertslive.co.uk/

MMS Midway Edition 2026 October 25-28, 2026 in San Diego. That’s fall, not late summer.

https://mmsmoa.com/

https://patchmypc.com/events/mms-2026-midway-edition/

Microsoft shipped PowerShell 7.7.0-preview.2 this week, and Tony Schultz over at the Icewolf blog flagged the change that matters most for anyone managing PowerShell on Windows at scale. Starting with 7.7-preview, there is no more MSI installer. The MSIX package becomes the primary install method on Windows, MSI continues for 7.6 but not future releases. Tony walks through running the new preview without and with the M365PSProfile module from his download of the ZIP. If you push PowerShell with Intune, ConfigMgr, or your own deployment plumbing, your packaging for 7.7 and beyond needs a rethink before this hits stable.

https://blog.icewolf.ch/archive/2026/05/28/powershell-v7-7-0-preview2-has-been-released/

Built In PowerShell Parameters You Should Be Using with Lucas Allman

Andrew Pla hosted Lucas Allman for a PowerShell Wednesday on the common parameters baked into every advanced function and cmdlet. Lucas walks through what an advanced function actually is, how CmdletBinding or a decorated parameter unlocks the full set, and why the six output streams exist as separate channels for success, error, warning, verbose, debug, and information. He also covers the action parameters and preference variables that change how your code reacts to traffic on those streams, including capturing stream output to a variable using InformationVariable. Part one of two. Lucas comes back next week for the more interesting ones including WhatIf and Confirm.

Microsoft Entra Tenant Governance: Find Configuration Drift

Microsoft Mechanics published a deep walkthrough this week on capturing your tenant configuration as code across more than 200 resource types spanning Entra, Intune, Exchange Online, Teams, Defender, and Purview, then turning that snapshot into an ongoing drift monitor. If you have ever wished you could diff your tenant the way you diff source control, this is exactly that workflow. The angle that should land hardest for our crowd is treating configuration as a versioned artifact, which finally gives PowerShell-driven environments a story for change management that does not depend on screenshots and prayer.

https://techcommunity.microsoft.com/blog/microsoftmechanicsblog/microsoft-entra-tenant-governance--find-configuration-drift/4523358

Useful PowerShell Scripts for Windows Admin Tasks

Andrew Pla at PDQ dropped a ten-script toolkit this week aimed at the practical endpoint questions you actually field every day, like which critical errors showed up in event logs, which scheduled tasks look suspicious, are certificates valid, is BitLocker enabled, what shape are the batteries in, what is mapped where, what browser and VS Code extensions are installed, do my config baselines hold, is Defender healthy, and is Secure Boot ready for the UEFI 2023 certificate changes. The scheduled task auditor is the standout for me. It flags hidden tasks, encoded commands, execution policy bypasses, user writable paths, web downloads, and known LOLBins in one pass. Worth lifting straight into your PowerShell Scanner library.

https://www.pdq.com/blog/useful-powershell-scripts-for-windows-admin-tasks/

Jeff Hicks Ships PSIntro, a Welcome Screen and Tutorial Set for PowerShell Beginners

Jeff Hicks built PSIntro, an educational module that grew out of conversations with Jason Helmick about giving brand new users a friendlier front door into PowerShell. It puts a splash style welcome screen in front of beginners when they start a session, complete with clickable links in Windows Terminal, and it ships a set of short interactive tutorials on core concepts like Get-Command, with live output pulled from the user’s own session so the lesson matches their real environment. There are also helper commands for the things beginners stumble on early, like checking whether key modules need updating with Get-ModuleStatus, reporting on where profile scripts live, and creating one with New-PSProfile. It runs on both Windows PowerShell and PowerShell 7 across Windows, Linux, and macOS, and it is localized for English, French, and German. If you mentor anyone just getting started, or you run a user group with newcomers, this is a thoughtful thing to point them at.

https://github.com/jdhitsolutions/PSIntro

Automate Platform SSO Setup During macOS Enrollment

Cindy Crane on the Microsoft Entra Blog has a nice walkthrough this week on automating Platform SSO setup as part of macOS enrollment in Intune. The shape of the win is the usual modern endpoint story, less user friction during onboarding and fewer of those tickets that are really just a confused first sign in. If you are pulling Mac users into a Microsoft first stack, this is the cleanest path to a single sign in experience that I have seen documented end to end.

https://techcommunity.microsoft.com/category/microsoft-entra/blog/microsoft-entra-blog

Harm Veenstra on the PSBoundParameters vs IsPresent Question

Harm Veenstra dropped a fresh post this morning that started from a conversation with a colleague over which approach is right for checking whether a switch or parameter was actually used in a script or function. He breaks down what each does, PSBoundParameters being the automatic hashtable that fills in with whatever parameter names and values were passed on the command line, IsPresent being the simpler true or false check on a switch. The walkthrough uses his own Update-Modules function as the example and shows the same Install-PSResource call written both ways so you can see them next to each other. The honest answer to which is better is the IT classic of it depends, but Harm makes the practical case for IsPresent on plain switch logic and PSBoundParameters when you want the full picture of what the caller actually specified, with the caveat that defaults set inline never show up in the hashtable. He also signed off with a tease that next week’s post will be his PSConfEU recap.

https://powershellisfun.com/2026/05/29/using-psboundparameters-or-ispresent-when-checking-powershell-switch-or-parameters-usage/

Daniel Bradley Publishes 1,400 Plus Microsoft Architecture Icons at msicons.com

Daniel Bradley collated more than 1,400 Microsoft architecture icons and put them all in one easy to search spot at msicons.com. For every icon you can grab the scalable SVG, pull a PNG at whatever size you need, or embed it straight into a website or markdown file, and you can flip between light, dark, and transparent backgrounds depending on where it is headed. There is a compare view for putting icons side by side and a favoriting feature so you can bulk download a whole set at once. I am flagging this one specifically because if you build visual PowerShell apps with something like WPF, WinForms, or a web front end, having a consistent and official looking icon set on hand makes a real difference for style consistency, and this is the cleanest place I have seen to pull them.

https://msicons.com/

Solving Problems at the Root with Mark Littlefield. The PowerShell Podcast E230

Sending a Welcome Message to New Employees Part 2

Tony Redmond is back with a follow up to his welcome email project, and this one is the PowerShell heavy half. Instead of attaching ICS files, this version uses Get-MgUserCalendarView and Update-MgUserEvent in the Microsoft Graph PowerShell SDK to find existing corporate calendar events, then quietly add new employees to the participant list so the meetings land on their calendars automatically. It is a cleaner pattern than building ICS bytes by hand, and the code is small enough to drop into an existing onboarding runbook without much surgery.

https://office365itpros.com/2026/05/27/new-employee-email2/

Reporting Usage Patterns for Room Mailboxes

Also from Tony this week, a practical look at finding out whether your room mailboxes are actually being used. The article weighs two paths, the classic Exchange Online PowerShell module versus the newer Graph Places API, and is honest about the permissions and ongoing run mechanics each one demands. The right answer probably depends on what else lives in your reporting pipeline, but the side-by-side here is exactly the comparison you want before you commit to one approach for a recurring report.

https://office365itpros.com/2026/05/26/room-mailboxes-usage/

What’s New in Microsoft Intune, May 2026

Scott Sawyer’s monthly Intune roundup updated this week with the May changes worth knowing, focused on Android, macOS, and certificate management refinements across the service. It is the post I always tell our team to read first when they want to know what changed without grinding through the message center one card at a time. If you are responsible for the Intune side of an environment, this is the cheapest five minutes you will spend on staying current.

https://techcommunity.microsoft.com/blog/microsoftintuneblog/what%E2%80%99s-new-in-microsoft-intune-%E2%80%93-may/4491984

Midwest Management Summit 2026

Kevin Levart shared his recap of MMS, and if you have somehow never made it, this is one of the most respected systems and endpoint management conferences in the country. The Mall of America edition wrapped up earlier this month in Bloomington, Minnesota, with the deep ConfigMgr, Intune, Azure, and PowerShell sessions it is known for, the attendance cap that keeps it small and personal, and the community energy regulars will not stop talking about. If you missed this one, the second 2026 edition heads to the Manchester Grand Hyatt in San Diego later in the year, so there is still a chance to get your MMS fix in 2026.

https://www.linkedin.com/pulse/midwest-management-summit-2026-kevin-levart-yq36c/

I Let Claude Take FULL Control of a Fresh Windows 11 PC (Debloat + Setup)

Memory gave Claude Code one prompt to set up a fresh Windows 11 install and let it run the PowerShell commands itself to remove bloat, install his apps, and lock down privacy in a VM. Cool watch and interesting concept; honestly the future of some development and testing.

Events

Microsoft Build 2026

Microsoft’s flagship developer conference runs June 2 to 3 this year, moving to San Francisco and online after its long run in Seattle. The focus is squarely on building and scaling AI, with the product teams going deep on real code and real systems. If you cannot make the trip, the online option is free and worth blocking off given how much of the year’s Azure, Microsoft 365, and developer tooling news tends to land at Build.

https://build.microsoft.com/

PowerShell Conference Europe 2026

The big one is just around the corner, June 1 to 4 in Wiesbaden, Germany. Heads up that ticket prices already moved to 1,950 euros as of May 11 with the event entering its final logistics phase, so if you have been sitting on the fence, the cost only climbs from here.

https://psconf.eu/

Jos Lieben spent his holiday weekend solving the two biggest things holding back wider Maester adoption, the painful installation process and the lack of visibility into remediation progress as new tests get added. DriftMaester gives you a fully automatic install that runs entirely in your own tenant using a single Azure automation account and a single storage account that the installer creates for you. It uses managed identity for all access so there are no secrets to rotate or expose, it updates both the tests and the module automatically, and it emails you when your security score drifts. If you have wanted to run Maester but bounced off the setup, this is the on ramp.

https://github.com/jflieben/DriftMaester

PingCastle vs PSGuerrilla: A Check by Check Comparison From the Person Who Wrote One of Them

I finally wrote up the comparison people have been asking me for since I started shipping PSGuerrilla. PingCastle is excellent software and I still tell every K12 director I know to run it, so this is not a takedown. It is an honest look at where the two tools overlap on the Active Directory side and where PSGuerrilla goes deeper, things like the modern ADCS escalation paths from ESC9 through ESC16, offline NTDS password auditing against HaveIBeenPwned, logon script body parsing, NTLM relay preconditions, and the Tier Zero hygiene checks that catch service accounts with DCSync rights hiding in plain sight. I also get into why I built it under a license that lets consultants, MSSPs, and pen testers use it commercially without per domain pricing, because the asymmetric defenders working in resource constrained environments are exactly the people who get priced out of good tooling. If you run AD, run both. If you want the cloud identity audit across Entra, Intune, M365, and Google Workspace for free, that part stops being a comparison pretty quickly.

psign Brings Portable Code Signing to Every Platform

Marc-André Moreau over at Devolutions just dropped psign, and it solves a problem that has annoyed me for years. Code signing has always meant keeping a Windows box around just to run signtool.exe, but psign lets you sign from Linux, handles every file format and signing method, and works with Azure Key Vault for the actual key material. You can grab the prebuilt Rust executables from GitHub Releases or install it as a dotnet tool with a single command. The detail I love is that psign-tool.exe itself is code signed from Linux using an Azure Key Vault, which is about as good a proof of concept as you could ask for.

https://github.com/Devolutions/psign

AutoRest Deprecation Raises Questions for the Microsoft Graph PowerShell SDK

Tony Redmond flagged something in his latest automation update that belongs on the radar of anyone who depends on the Microsoft Graph PowerShell SDK. Back in February Microsoft quietly posted a deprecation and retirement notice for the AutoRest utility, which is the tool deeply embedded in the pipeline that generates the SDK from the OpenAPI documentation for the Graph APIs. Most of us, Tony included, missed the notice when it first went up. He walks through what AutoRest actually does in that generation process and what its retirement could mean for the future cadence and stability of the SDK we all build automation on top of. The new V2.37 release looks stable so far, but this is a thread worth keeping an eye on.

https://office365itpros.com/2026/05/20/automating-microsoft-365-ps24/

GPT-5.5 Instant Lands in Microsoft 365 Copilot

Microsoft brought OpenAI’s GPT-5.5 Instant into Microsoft 365 Copilot and Copilot Studio, replacing GPT-5.3 Instant as the quick response model across Word, Excel, Outlook, Teams, and the rest of the suite. The pitch is more accurate and concise answers with better image analysis and stronger performance on STEM tasks, plus less of the back and forth and follow up questions that made earlier models tedious. In Copilot Chat it shows up as GPT-5.5 Quick response in the model selector, and licensed users get priority access. For agent makers it is rolling out in Copilot Studio as GPT-5.5 Chat and is available in Foundry. Nothing in your ribbon changed, the model under the hood just got better.

https://techcommunity.microsoft.com/blog/microsoft365copilotblog/available-today-gpt-5-5-instant-in-microsoft-365-copilot/4517084

Detecting Orphaned Azure Resources at Scale with KQL and PowerShell

This is a genuinely useful walkthrough on hunting down the orphaned resources quietly draining your Azure bill, the unattached disks, the NSGs associated with nothing, the app service plans with no apps deployed, and the load balancers with no backend pools. The clever framing is that instead of asking what is being used, you ask what is not connected to anything, which turns this into one of the easier cleanup wins out there. The presenter credits Dolev Shor’s excellent orphaned resources workbook for the underlying KQL, then shows how to lift those queries into PowerShell, query Azure Resource Graph across the whole tenant, and tie every finding back to a resource owner tag so the right person gets the email about their own mess rather than you chasing it down. The payoff is a scheduled runbook in an Azure automation account that mails each owner an HTML report with clickable links straight to the resource and the specific issue flagged in red. When they ran it in their own environment they turned up enough forgotten disks to save tens of thousands of dollars a year.

Block Microsoft 365 Apps Using Conditional Access, and How to Script It

Prajwal Desai has a clean walkthrough of building a Conditional Access policy in Entra to block Microsoft 365 apps on unmanaged or BYOD devices, complete with the report only testing approach and the break glass account exclusions you should never skip. His guide lives entirely in the portal, so here is the PowerShell angle for those of us who would rather not click through seven blades. The Microsoft Graph PowerShell SDK exposes the whole thing through New-MgIdentityConditionalAccessPolicy, where you define the conditions, the included and excluded users, the target apps, the device platforms, and the grant control as a structured object. The smart move is to create the policy with its state set to enabledForReportingButNotEnforced first, confirm the blast radius in the sign in logs, and then flip it to enabled once you trust it. Same logic Prajwal describes in the GUI, just version controlled and repeatable.

https://www.prajwaldesai.com/block-microsoft-365-apps-using-conditional-access-policy/

IntuneAutomation Ships a Free AI PowerShell Script Generator

Ugur Koc added a script generator to IntuneAutomation that turns plain English requests into production ready PowerShell for Intune and Microsoft Graph, and it is genuinely thoughtful about the things that usually make AI generated scripts dangerous. Every script runs through six checks covering metadata, real Graph permission scopes validated against the official list, security and injection risks, runtime correctness, destructive operation safety that enforces SupportsShouldProcess on anything that wipes or deletes, and validation of every Graph endpoint against the published catalog. It needs no sign in, does not store your prompts, and scrubs obvious secrets before sending. It also happens to run on Claude, which gave me a chuckle given how I assemble this newsletter. Free with a daily limit, and a solid starting point even if you plan to harden the output yourself.

https://www.intuneautomation.com/generator/

Microsoft.Online.SharePoint.PowerShell 16.0.27215.12001 Released

Tony Schultz at the Icewolf blog notes that Microsoft shipped a new build of the SharePoint Online Management Shell. His writeup doubles as a good reminder to move to the modern PSResourceGet cmdlets like Get-InstalledPSResource and Find-PSResource instead of the older PowerShellGet commands when you check versions and update. He also raised a real question about uninstall problems that may be tied to CurrentUser scope getting redirected to OneDrive, so if you have run into that yourself, he is looking for confirmation.

https://blog.icewolf.ch/archive/2026/05/20/powershell-module-microsoft-online-sharepoint-powershell-16-0-27215-12001/

PowerShell After Dark: OnRamp, IoT, and Finding Your People

Andrew Pla took his mic to the hotel bar at the PowerShell and DevOps Global Summit for an After Dark episode of the PowerShell Podcast, and it is the kind of conversation that reminds you the community side of PowerShell matters as much as the syntax. He sits down with four attendees, starting with Josh Gratton, a 2026 OnRamp scholarship recipient who went from fifteen years in another field to the service desk to a systems engineering role on the strength of PowerShell automation, and who left Bellevue already planning to speak at a future Summit. From there it is Mark Go on his IoT and hardware work, Craig Mileham soaking up his first Summit while running MSP support in higher ed, and Matt Zaske, the Home Assistant and soldering enthusiast who ran a lightning demo and blogs over at mzonline.com. The thread Andrew keeps pulling on across all four is worth hearing if you have been lurking on the sidelines. Beginners belong here, reaching out is the move, and the distance between an online community and your people closes fast once you are in the same room.

MicrosoftPlaces PowerShell Module 2.1.7

Also from Tony Schultz this week, MicrosoftPlaces 2.1.7 is out. The headline change is a new IsAutoGenerated property exposed on Get-PlaceV3 so you can tell whether a place object was auto created by Microsoft rather than defined by an administrator. If you are managing Places for room and desk booking, this is a small but useful addition for cleaning up and auditing your place data. You will need Exchange or Places administrator rights to connect and pull the configuration.

https://blog.icewolf.ch/archive/2026/05/19/microsoftplaces-powershell-module-2-1-7-has-been-released/

Merill Fernando Launches a Weekly Microsoft AI Roundup

Merill Fernando, the person behind entra.news and the Maester project, just launched a new weekly newsletter called Merill’s Weekly Microsoft AI Roundup. It covers the most important updates across Microsoft 365 Copilot, GitHub Copilot, Azure AI Foundry, Copilot Studio, Security Copilot, Fabric, Microsoft Agent 365, and the wider community, which is a lot of ground that has been genuinely hard to track in one place. If you already lean on entra.news to keep up with identity, this is the same treatment for the AI side of the ecosystem. Worth a subscribe while it is still early.

Merill's weekly Microsoft AI roundup

Your weekly guide to the most important Microsoft AI updates across Microsoft 365 Copilot, GitHub Copilot, Azure AI Foundry, Copilot Studio, Security Copilot, Fabric, Microsoft Agent 365, and the wider community.

By Merill Fernando

Winget Inside Intune Remediation Scripts with David Sass

This PSConfEU session from David Sass is making the rounds again, and for good reason. He shows how to build smarter Intune remediation scripts powered by Winget so you can deploy and update software across your fleet without paying for extra add ons. He covers capturing logs and telemetry with Application Insights, troubleshooting execution with proper output and exit codes, and the real world lessons from running this in a hardened enterprise environment. If you have been justifying paid app management tooling to your budget holders, this one might change the conversation.

Events & Groups

PowerShell Conference Europe 2026

The big one is just around the corner, June 1 to 4 in Wiesbaden, Germany. Heads up that ticket prices already moved to 1,950 euros as of May 11 with the event entering its final logistics phase, so if you have been sitting on the fence, the cost only climbs from here.

https://psconf.eu/

PowerShell Ohio User Group Launches

Stephen Valdinger, Ryan Richter, and fellow MVP Jake Hildreth have teamed up to launch PowerShell Ohio, a new user group for the PowerShell curious, the enthusiasts, and the seasoned pros to learn, laugh, and build community around automation. The site and Meetup page are live now, and they are working out the logistics for a first meeting. Join the Meetup to get notified once they start scheduling.

https://psoh.io/

A couple of years ago I was driving to work listening to PDQ’s PowerShell Podcast, hosted by the one and only Andrew Pla, and Spencer Alessi was on talking about Active Directory security tooling. He brought up PingCastle. I had not used it. I downloaded it that afternoon, ran it against our domain, and within the hour I had a list of findings I had not seen before. A few months later I was on stage at MAEDS giving a talk called Securing Active Directory with PowerShell and Other Tools, and PingCastle was in the slide deck. I told a room of Michigan K-12 IT directors to go run it.

I still tell people to run it. PingCastle is good software. Vincent Le Toux has been maintaining it for the better part of a decade, the scoring model is calibrated against more real environments than anyone else’s, and the HTML report is the closest thing our industry has to a shared vocabulary for AD posture. If you have ever sat in a room where two engineers compare AD environments by maturity level, PingCastle is the reason that conversation is possible.

A note on scope before I go further. PSGuerrilla is not an AD-only tool. It ships 431 security checks across four theaters: Google Workspace (98 checks), Active Directory (175 checks), Entra ID, Azure, Intune, and M365 (159 checks), and continuous monitoring on top of all of it. PingCastle is fundamentally an AD tool with a separate paid Cloud Edition for Entra. So a fair comparison is really just the AD piece. That is what most of this article is about. But I want to be honest up front that the cloud side is not a place PingCastle wins. It is a place PSGuerrilla extends much further by the end.

So why did I build PSGuerrilla?

Why I built it anyway

Two reasons. The first is structural and the second is philosophical, and they reinforce each other.

The structural one is that PingCastle’s coverage stops where Vincent’s roadmap stops and there are categories of AD risk in 2026 that did not exist when the original rule set was written. ADCS escalation is the obvious example. ESC1 through ESC8 were documented in SpecterOps’ Certified Pre-Owned paper and PingCastle covers them well. ESC9 through ESC16 and EKEUwu were published after PingCastle’s ADCS module was written, and templates that pass PingCastle’s checks can still get you domain owned via ESC9 or ESC13. Same story with NTDS hash analysis, logon script body parsing, NTLM relay preconditions as a category, and Tier-0 hygiene for accounts that are functionally Tier-0 but do not appear in standard privileged group enumeration. Someone needed to write the checks.

The philosophical reason is that PingCastle Basic Edition is free for internal IT, but not for security consultants, MSSPs, pen testers, or auditors running it against client domains. For those use cases you need one of PingCastle’s commercial licenses (Auditor or Enterprise, depending on the engagement). That is a defensible business model. Vincent is well within his rights to fund the project that way and the per domain cost is reasonable. But it cuts out the people who deliver findings for a living without a budget for tooling, and it cuts out the consultancies that work with under resourced organizations. K-12 districts, county governments, rural hospitals, and small nonprofits, which are the places I spend most of my career thinking about, almost always get audited by someone who is bringing their own tools to the engagement.

I run the IT department for a public Michigan school district of about 4,900 students across 10 buildings. I know what the tooling budget looks like at that scale. The same dynamic plays out at every district my size in the state and most of the country. The principle I keep coming back to is that asymmetric defenders in resource constrained environments need asymmetric tools. That is the whole point of what I call Guerilla Zero Trust: high impact, low cost defenses that do not require a million dollar SOC stack to operate. PSGuerrilla is licensed under CC BY 4.0. Internal IT, consultants, MSSPs, pen testers, and red teams can all use it commercially. No per domain pricing, no commercial license tier, no usage gate. That license model is the actual headline.

The technical comparison below is what justifies the existence of the second tool. The license is what justifies who gets to use it.

The headline numbers for the AD side

PSGuerrilla’s Invoke-Reconnaissance cmdlet (the Active Directory module specifically) ships 203 AD security checks across 14 categories. Every one is callable as a standalone PowerShell function and documented with a stable check ID:

Category Count Prefix Privileged Account Hygiene 30 ADPRIV- Group Policy 24 ADGPO- Password Policy + NTDS 22 ADPWD- Domain / Forest 20 ADDOM- Certificate Services 19 ADCS- ACL / Delegation 16 ADACL- Logon Scripts 11 ADSCRIPT- Kerberos 11 ADKERB- Trusts 11 ADTRUST- Stale Objects 11 ADSTALE- Network (NTLM relay) 10 ADNET- Tier-Zero Hygiene 7 ADTIER- Logging Posture 7 ADLOG- Tradecraft Indicators 4 ADTRADE-

PingCastle ships roughly 150 rules in its scoring engine across anomalies, privileged accounts, stale objects, and trusts. The categories overlap significantly with mine, but the depth varies category by category. The gap is not uniformly 53 checks. In some areas PingCastle is at parity. In others it is much wider than the totals suggest.

ADCS: where the gap is widest

Active Directory Certificate Services is the single area where the difference matters most.

PingCastle covers the classic ADCS escalation paths from the original Certified Pre-Owned paper, ESC1 through ESC8. That coverage is solid and stable.

PSGuerrilla ships the full modern escalation surface:

• ADCS-002 ESC1: Enrollee Supplies Subject Alternative Name

• ADCS-003 ESC2: Any Purpose Extended Key Usage

• ADCS-004 / ADCS-005 ESC3: Enrollment Agent Template Abuse (both conditions)

• ADCS-006 / ADCS-007 ESC4: Vulnerable Template ACLs and Ownership

• ADCS-008 ESC5: Vulnerable PKI Object ACLs

• ADCS-009 ESC6: EDITF_ATTRIBUTESUBJECTALTNAME2 Flag

• ADCS-010 ESC7: Vulnerable CA ACLs

• ADCS-011 ESC8: NTLM Relay to AD CS HTTP Endpoints

• ADCS-012 ESC9: No Security Extension

• ADCS-013 ESC11: RPC Relay Without Encryption

• ADCS-014 ESC13: Issuance Policy OID Group Link

• ADCS-015 ESC15: Application Policies in Schema v1 Templates

• ADCS-016 ESC16: UPN SAN Misconfiguration

• ADCS-017 EKEUwu: Extended Key Usage Abuse

• Plus CA server inventory (ADCS-001), template enumeration (ADCS-019), and CA auditing configuration (ADCS-018)

ESC9 through ESC16 plus EKEUwu represent attack paths documented after PingCastle’s ADCS module was originally written. Templates that pass PingCastle’s checks can still be exploited via ESC9 (no security extension allows certificate requests from a user account with a manipulable altSecurityIdentities mapping) or ESC13 (issuance policy linked to a group SID). If you have an internal PKI and you have not audited it since 2022, PSGuerrilla will find paths PingCastle does not surface. I have watched this happen in production.

The NTDS password audit nobody else ships free

PSGuerrilla integrates DSInternals to read NTDS.dit offline (no domain impact, optional DC backup path) and runs four distinct checks against the resulting hashes:

• ADPWD-010 Users with Blank Passwords (Critical)

• ADPWD-011 Duplicate Password Hashes (High)

• ADPWD-012 Passwords in HaveIBeenPwned Database (High)

• ADPWD-014 Default/Common Passwords (High)

Plus tier aware cross references via ADPRIV-016 (Privileged Accounts Weak Passwords).

PingCastle does not ship offline NTDS hash analysis or HIBP integration in the Basic edition. The typical adjacent tool here is Specops Password Auditor, which is a separate product with separate licensing. PSGuerrilla ships it as part of Invoke-Reconnaissance. The HIBP corpus downloads once and updates via Update-ThreatIntel.

This is the single most operationally useful finding most environments can generate. A privileged account password that appears in HIBP is a meeting on Monday morning. I have run this against my own domain and against domains I have been allowed to test. It surfaces real issues on the first run, every time.

Logon scripts, NTLM relay, and tradecraft

Three categories I treat as first class concerns that PingCastle treats more lightly in my opinion.

Logon Script Analysis (11 checks, ADSCRIPT-001 through ADSCRIPT-011) parses every .bat, .cmd, .ps1, and .vbs in SYSVOL and Netlogon. It flags hardcoded credentials (ADSCRIPT-004), LOLBins usage (ADSCRIPT-005), plaintext passwords (ADSCRIPT-006), world-writable script permissions (ADSCRIPT-007), external resource references (ADSCRIPT-008), and UNC paths to non-DC locations (ADSCRIPT-010). In any environment older than five years, this category returns findings on the first run. I built it because I have seen what lives in SYSVOL at districts that inherited their domain from a previous administrator. PingCastle catches the GPP cpassword leftovers but does not parse script bodies at this level.

Network NTLM Relay Preconditions (10 checks, ADNET-001 through ADNET-010) covers the conditions that make Responder, mitm6, and Print Spooler relay attacks work. LDAP Signing required (ADNET-001), LDAP Channel Binding enforced (ADNET-002), SMB Server/Client Signing required (ADNET-003/004), LLMNR disabled (ADNET-005), NetBIOS-over-TCP reviewed (ADNET-006), IPv6 mitm6 mitigation posture (ADNET-007), WPAD auto-discovery disabled (ADNET-008), Print Spooler on DCs (ADNET-009), WebClient service default state (ADNET-010). PingCastle covers LDAP and SMB signing. The WPAD, LLMNR, IPv6, and WebClient surface as a dedicated category is mine.

Tradecraft Indicators (4 checks, ADTRADE-001 through ADTRADE-004) is small but distinctive. ADTRADE-001 finds GPP cpassword leftovers in SYSVOL (the 2014 vulnerability that still lives in production environments today; I have found this in district domains in the last twelve months). ADTRADE-002 checks for DCShadow indicators (rogue configuration partition servers that signal a sophisticated persistence technique). ADTRADE-003 catches stale BitLocker recovery keys. ADTRADE-004 audits RODC Password Replication Policy hygiene. PingCastle catches the cpassword issue. The other three are PSGuerrilla originals.

Tier-Zero hygiene: the tier-bleed problem

My ADTIER-001 through ADTIER-007 checks address a category PingCastle largely does not cover: service accounts that are effectively Tier-0 but do not appear in standard privileged group enumeration.

The flagship example is ADTIER-001 (Azure AD Connect MSOL_ Audit). When Azure AD Connect installs in Express mode, it creates a domain account named MSOL_<random-hex> and grants it Replicating Directory Changes plus Replicating Directory Changes All on the domain naming context. That is DCSync rights. The account is functionally a domain takeover if compromised. It lives in the default Users container, has a 10 year password expiry, and rarely appears in Domain Admins enumeration because it gets its power via direct ACL rather than group membership. Most AD tools miss it. I have personally found this account misconfigured in environments that had been audited by other tools and passed.

ADTIER-002 through ADTIER-005 extend the same logic to backup software service accounts (Veeam, CommVault), hypervisor accounts (vCenter), configuration management (SCCM), and SQL service accounts that have crept into Tier-0 groups over time. ADTIER-006 flags Tier-0 admins living outside dedicated Tier-0 OUs. ADTIER-007 flags service accounts that hold interactive logon rights via privileged group membership, which violates the Microsoft tier model.

This is one of the highest signal categories in a modern AD audit. Hybrid identity environments accumulate these accounts across change windows nobody documents. PSGuerrilla checks for them by default.

Logging posture

PingCastle does not audit logging configuration as a distinct category. My ADLOG-001 through ADLOG-007 covers the controls that determine whether an incident response would actually have data to work with:

• ADLOG-001 Advanced Audit Policy configured

• ADLOG-002 PowerShell Script Block Logging enabled

• ADLOG-003 PowerShell Module Logging enabled

• ADLOG-004 Process Creation Auditing with command line (Event 4688)

• ADLOG-005 Microsoft Defender Tamper Protection policy

• ADLOG-006 Windows Event Forwarding (WEF) Subscription Manager configured

• ADLOG-007 Sysmon deployment indicator

This category does not change the attack surface. It changes what is recoverable when something goes wrong. Worth running for that reason alone, and a category I care about deeply because I have sat in incident calls where the question of “do we have logs for that” had a bad answer.

What PingCastle still wins on

I want to be careful here. PingCastle is not behind on every front, and I am not trying to suggest otherwise. Several things it does that PSGuerrilla either does not match or covers differently:

• The Healthcheck XML primitive. PingCastle uses this as a stable cross environment data format. It is useful for trend analysis across multiple domains, especially in MSSP contexts (with an Auditor or Enterprise license).

• Scoring model maturity. PingCastle’s 0 to 100 risk score is calibrated against several years of real world data, and the Maturity Level framework is widely recognized. PSGuerrilla has its own Guerrilla Score with FORTRESS, DEFENDED POSITION, CONTESTED GROUND, EXPOSED FLANK, UNDER SIEGE, and OVERRUN tiers, but PingCastle’s calibration history is longer.

• Trust analysis depth on the AD side. PingCastle’s multi-forest trust mapping is mature and well tested. PSGuerrilla covers AD trusts in 11 checks but does not visualize the relationships the same way.

• Single binary deployment. PingCastle runs as one .exe. PSGuerrilla requires PowerShell 7 and the DSInternals module for the NTDS checks. If you need to run something on a locked down jump host with no PowerShell modernization story, PingCastle is easier to deploy.

If your organization has standardized on PingCastle and your team understands the scoring model, there is no reason to abandon it. The two tools coexist well. PSGuerrilla fills the AD categories PingCastle does not cover, extends into Entra, M365, and Workspace that PingCastle does not touch in the free tier, and offers a license model that fits engagements PingCastle’s free tier does not.

Beyond AD: where the comparison stops being a comparison

PingCastle is at its core an AD tool. PingCastle Cloud Edition is a paid add-on that crosses into Entra. That is a fair business decision. But it is worth being precise about what it means: in the free tier, PingCastle does not audit Entra ID, M365, Intune, or Google Workspace at all. PSGuerrilla does all four, by default, under the same CC BY 4.0 license, in the same module.

Invoke-Infiltration runs 159 checks across Entra ID, Azure, Intune, and M365. That covers Conditional Access, PIM, application consent grants, risky sign-ins, Exchange Online security posture, SharePoint sharing settings, Teams external access, Intune compliance policies, and the rest. Invoke-Fortification runs 98 checks against Google Workspace, covering admin console hardening, OAuth third party app review, Drive sharing posture, Gmail security defaults, audit log configuration, and 23 behavioral detection signals via Invoke-Recon. I built the Workspace side first because I run a Google district, and I needed something that audited Workspace the way PingCastle audits AD. There was nothing free that did it.

The continuous monitoring layer is where the multi-theater design starts to pay back. Invoke-Surveillance watches Entra ID for sign-in risk and directory changes. Invoke-Watchtower does baseline drift detection against AD. Invoke-Wiretap tails the M365 unified audit log for Exchange, SharePoint, Teams, Defender, and Power Platform events. Patrols schedule any of these via Register-Patrol and route alerts through nine providers: Teams, Slack, PagerDuty, Twilio, SendGrid, Mailgun, generic webhook, Syslog CEF/LEEF, and Windows Event Log.

For K-12 specifically, there is a K12 scoring profile and a compliance crosswalk that maps findings to FERPA, COPPA, CIPA, NIST 800-171, and state ed tech frameworks. That is built in. Nobody else ships this for free (and I need it bad!).

If you want to do an apples to apples comparison on cloud identity, you would need PingCastle Cloud Edition (paid) on one side and Invoke-Infiltration (free) on the other, and at that point you are not really comparing the same product anymore.

Output and remediation

Where PingCastle stops at the report, PSGuerrilla pairs every finding with a remediation. I built it this way because in my day job I do not have a remediation team. I have me, and I have a small team of people who already have full plates. If I am going to ship a tool that produces 150 findings, I owe my own future self a way to work through them without writing 150 PowerShell scripts.

Export-TechnicalReport ships each finding with check ID, current value, recommended value, severity, MITRE ATT&CK mapping, CIS Benchmark citation, NIST SP 800-53 and 800-171 references, and step by step remediation. Export-RemediationScripts writes one .ps1 per finding, each with a safety preamble and rollback comments. Export-ExecutiveSummary produces a one page document for the board. Export-BudgetJustification groups remediations by cost tier so leadership can make funding decisions.

For a 150 finding environment, that turns a six week remediation sprint into a structured backlog where each ticket carries the script attached. Nothing auto-applies. The intended workflow is read, scope, approve, execute.

How this is being built

I should be direct about something. I am not writing all 431 of these checks by hand. PSGuerrilla is being built with the assistance of AI tools doing a lot of the implementation, with my expertise and lived experience as the watchful eye over every commit. I know what a misconfigured MSOL_ account looks like in production because I have found one. I know what GPP cpassword leftovers do in a real district because I have cleaned them up. The agentic tools accelerate the work. The judgment about what to check, why it matters, and what the remediation actually has to do is mine.

I am also actively stress testing the module against sample environments to verify the checks behave correctly across configurations I do not run in production. That work is not glamorous and it does not show up in a demo, but it is the difference between a tool that runs and a tool that runs reliably.

My advice for anyone reading this who has thought about building their own tooling: take the PSGuerrilla base, drop it in your own repo, and let Copilot CLI loose on it to customize it to your environment. Add your own checks. Tune the scoring weights. Wire up the alerting providers you actually use. The CC BY 4.0 license exists precisely so this is allowed.

Building modules without agentic AI in 2026 seems nuts to me at this point. The tools are too good. The leverage they give a single practitioner who knows what they want is too high. If you are an IT director at a district my size and you are sitting on tribal knowledge about your environment that nobody else has, that knowledge plus an agentic editor is enough to produce something worth running. The barrier to making real tools has collapsed. Expertise still matters. Judgment still matters. The willingness to actually ship still matters. What has changed is how much typing sits between those things and a working module.

How to use both

The honest recommendation for AD specifically is to use both, at least initially. PingCastle’s scoring is a useful reference point and the Maturity Level framework gives leadership a familiar yardstick. PSGuerrilla extends the AD coverage into ADCS depth, NTDS password analysis, logon scripts, NTLM relay preconditions, Tier-0 hygiene, logging posture, and tradecraft indicators that PingCastle does not surface. Then it keeps going into Entra, Azure, Intune, M365, and Google Workspace that PingCastle’s free edition does not touch.

For internal IT teams: run both on the AD side. PingCastle Basic is free for you. PSGuerrilla fills the AD gaps and gives you the cloud identity audit on top.

For consultants, MSSPs, pen testers, and analysts who need to deliver findings to clients without per-engagement licensing: PSGuerrilla is CC BY 4.0 across all 431 checks. Attribute the source in the report (a footnote suffices) and ship.

Trying it

PSGuerrilla is published to the PowerShell Gallery at powershellgallery.com/packages/PSGuerrilla, so for most people the install is one line. For the AD audit specifically, you do not need to set anything else up. PSGuerrilla uses your current Kerberos session, so if you are running from a domain-joined machine with appropriate read rights, you can go from Install-Module to running checks in two commands.

# Install from the PowerShell Gallery (recommended)
Install-Module PSGuerrilla
Import-Module PSGuerrilla

# AD audit. No vault setup needed. Uses your current Kerberos session.
Invoke-ADRecon                  # alias for Invoke-Reconnaissance

# For cloud audits, set up the encrypted credential vault first
Set-Safehouse
Invoke-Infiltration             # Entra / Azure / Intune / M365 (159 checks)
Invoke-Fortification            # Google Workspace (98 checks)

# Or run everything in one go after Set-Safehouse
Invoke-Campaign

# Alternative install path if you want the latest unreleased changes
# git clone https://github.com/jimrtyler/PSGuerrilla.git
# Import-Module ./PSGuerrilla/PSGuerrilla.psd1

For the AD audit, no credential setup is needed when running from a domain-joined machine. Add Install-Module DSInternals if you want the NTDS hash analysis. For the cloud paths you will need an Entra app registration with the right Graph scopes (the README walks through it) and, for Workspace, a GCP service account with domain wide delegation. Both of those credentials live in the safehouse vault that Set-Safehouse creates.

The first run produces the executive summary, technical report, remediation playbook, and per-finding scripts. The technical report includes every check ID, observed value, recommended value, and remediation steps. The remediation scripts go into a separate folder. Nothing runs automatically.

PSGuerrilla is at guerrilla.army. The site includes an interactive configuration builder that generates the JSON config file for whichever environments you want to audit. Source is at github.com/jimrtyler/PSGuerrilla. CC BY 4.0.

PingCastle is at pingcastle.com. Commercial licensing (Auditor, Enterprise, and Cloud Edition) is per-domain.

The right answer for most teams on the AD side is both, for different reasons. The right answer for the cloud side is the tool that audits it for free. The right answer for analysts who bill for the work is the tool that does not charge per engagement.

Report what you find

PSGuerrilla will encounter edge cases in environments I have not tested against yet. That is the nature of shipping a security module that touches six different identity platforms across whatever combination of legacy and modern configurations your domain has accumulated since it was stood up. If you hit a check that produces a false positive, a missing dependency, an unhelpful error message, or a remediation script that does the wrong thing in your environment, open an issue at github.com/jimrtyler/PSGuerrilla/issues. The more specific the better. Versions, OS, domain functional level, the exact check ID, and anonymized output if you can share it. The faster I see it, the faster I can fix it for everyone running the next version.

If you build your own checks on top of the base and want them merged upstream, pull requests are welcome too. Thanks for reading if you’re still here!

PowerShell Automation for Sysadmins: Working Smarter With Three MVPs and 500 Attendees

So this is a little embarrassing. I joined Andrew Pla and Steven Judd for the PDQ webcast on PowerShell automation for sysadmins on May 13, three Microsoft MVPs talking for an hour about how PowerShell helps you stop doing sysadmin work the hard way, and I somehow managed to put together this entire newsletter without mentioning it once. Over 500 of you joined us live, which still kind of blows my mind. We covered how to figure out which tasks to automate first, why reporting and visibility scripts are the safer starting point than anything destructive, how Andrew thinks about going from reactive to proactive, why Steven hammers on the object oriented nature of PowerShell as the thing that trips people up early, and how I keep my K12 environment from imploding during student rollover when thousands of accounts need to move between organizational units at once. The full recording is on demand now, and Meredith Kreisa at PDQ wrote up an excellent companion piece that captures the whole conversation.

Watch it here: https://www.pdq.com/events/it-exchange-may2026/

Blog based on it here: https://www.pdq.com/blog/powershell-automation-for-sysadmins/

Patch Tuesday May 2026: 118 CVEs, 16 Critical, and a Dynamics 365 RCE That Demands Attention

Brock Bingham at PDQ has the full Patch Tuesday breakdown for May, and this one earned its keep. Microsoft addressed 118 CVEs with 16 rated critical, headlined by CVE-2026-42898, a Dynamics 365 remote code execution flaw scoring 9.9, and CVE-2026-41096, a 9.8 DNS Client RCE that should be patched in every environment yesterday. There is also a cluster of seven critical Office RCEs and a Hyper-V issue worth reading up on before you cut your maintenance window.

https://www.pdq.com/blog/patch-tuesday-may-2026/

Microsoft.Graph PowerShell Modules 2.37.0 Released

Tony Schultz at Icewolf has the quick rundown on the latest Microsoft.Graph PowerShell module release. Version 2.37.0 is now on the PowerShell Gallery and brings the usual mix of cmdlet additions, schema updates, and fixes that come with each release. If you are running automation that depends on Graph cmdlets, this is the kind of update you want to test in a lab before rolling into production scripts.

https://blog.icewolf.ch/archive/2026/05/13/microsoft-graph-powershell-modules-2-37-0-released/

Understanding How Graph Permissions for Groups Actually Work

Tony Redmond breaks down one of the more confusing corners of Microsoft Graph, the difference between Group.Read.All and GroupMember.Read.All and the implications for any app or PowerShell script that touches groups. The piece is a strong walk through of why the principle of least privilege matters here, what each permission actually unlocks, and how to reason about scopes when designing automation. If you have ever requested a wider permission than you really needed because the docs were unclear, this one is worth your time.

https://office365itpros.com/2026/05/13/graph-permissions-groups/

Dynamically Removing Preinstalled Microsoft Store Apps Using Native Functionality

Peter van der Woude has a great writeup on the native dynamic MSIX and APPX removal capability that arrived with Windows 11 24H2. No more debloat scripts, no more wrestling with provisioning packages that leave behind ghosts. Peter walks through how the native functionality actually works, how to target specific preinstalled apps, and what the Intune configuration looks like end to end. If you have been waiting for a clean built in answer to the bloatware problem, this is the post that explains how to use it.

https://petervanderwoude.nl/post/dynamically-removing-preinstalled-microsoft-store-apps-using-native-functionality/

Built In PowerShell Parameters You Should Be Using with Lucas Allman

Andrew Pla hosted Lucas Allman on PowerShell Wednesday this week for a beginner friendly walkthrough of the common parameters that get baked into every advanced function and cmdlet, and it is one of those topics that quietly separates people who write PowerShell from people who write good PowerShell. Lucas covers what an advanced function actually is, how a single CmdletBinding attribute or a decorated parameter unlocks the full set of common parameters for you, and why the six output streams exist as separate channels for success, error, warning, verbose, debug, and information. Good watch :)

Controlled Configuration for Microsoft Defender Antivirus Settings

Rudy Ooms has another excellent OSINT style investigation, this one digging into the ControlConfigAdapter component that Microsoft has been quietly building into Defender for managing antivirus configuration in a controlled, drift-resistant way. The post explains what the component does, where it lives, and how it interacts with the rest of the Defender configuration story. Rudy is one of the few people writing at this level of detail about Microsoft Endpoint internals, and this is required reading if you manage Defender at scale.

https://patchmypc.com/blog/controlled-configuration-for-microsoft-defender-antivirus-settings/

DSC v3.2.0 Hits GA with New Windows Resources, Version Pinning, and Experimental Bicep Integration

The 4sysops team has a solid breakdown of what landed in Microsoft Desired State Configuration v3.2.0, which reached general availability on April 29 and is rolling out into wider awareness now. The release brings built in resources for services, firewall rules, and SSH settings, extends the what-if preview mode to individual resources, introduces version pinning, and includes experimental Bicep integration over gRPC. The article walks through what changed since v3.1, the limitations to watch for, and how to install the update via winget.

https://4sysops.com/archives/dsc-v3-2-0-new-windows-resources-version-pinning-and-bicep-integration/

Upcoming Events

PSConfEU 2026 June 1-4, 2026 in Wiesbaden, Germany

https://psconf.eu/

Michael Suhl joined Mike Kanakos and Phil Bosman on the Research Triangle PowerShell User Group to tackle one of the most frustrating conversations any of us have when starting a new job, which is being told that PowerShell is too dangerous to enable. Mike walks through how to actually have the risk conversation with your GRC team, breaks down where PowerShell shows up in the MITRE ATT&CK framework, and lays out a stack ranked list of mitigations from low effort wins like audit logging and EDR all the way up to the heavy lifts like script signing, WDAC, JEA, and host based firewalls. The real gold is a slide mapping all of those controls to effort and benefit, and a teaser for a module he is calling PSART that codifies the Australian Signals Directorate guidance into deployable PowerShell.

Introducing Commercial Vantage Policy Manager for Intune

For those of you managing Lenovo devices, this post from Philip Jorgensen is a must read. He has built a new PowerShell UI tool that lets you create OMA-URI policies for Lenovo Commercial Vantage settings without having to ingest the ADMX templates the traditional way. Big quality of life improvement if you have been wrestling with this in your tenant.

https://blog.lenovocdrt.com/introducing-commercial-vantage-policy-manager-for-intune

Protecting Profiles

Jeff Hicks dropped a new Behind the PowerShell Pipeline post this week walking through how to protect your PowerShell profile scripts from tampering. He uses Get-FileHash and MyInvocation to build a function that verifies the profile has not been modified since you last approved it, which is a clever defensive technique most people overlook. If your profile is loading modules, setting aliases, or doing anything privileged, this is worth a read.

https://buttondown.com/behind-the-powershell-pipeline/archive/protecting-profiles/

Locking Down Windows Devices by Suppressing Key Combinations

Peter van der Woude has a practical post on using the built in Windows Keyboard Filter feature to suppress specific key combinations on shared, kiosk, or locked down devices. The post walks through enabling the feature with a single PowerShell command, configuring blocked combinations through some old school WMI work against the WEKF_PredefinedKey class, and deploying everything via Intune Win32 apps. Useful reference if you are managing any kind of restricted device fleet.

https://petervanderwoude.nl/post/locking-down-windows-devices-by-suppressing-key-combinations/

Shift Happens: Two Command Injections in Windows Context Menus

Remi Gascou over at SpecterOps published a fascinating piece of research uncovering two command injection vulnerabilities in the built in Windows Explorer “Open PowerShell window here” context menu, triggered by crafted folder names. One variant affects modern Windows 11 builds and the other has existed since Windows 10 1703 back in April 2017, meaning this has been sitting quietly in Windows for nearly nine years. The most interesting section is at the end where Remi shows that LLMs trained on this period of Windows documentation now confidently reproduce the vulnerable command template when asked to set up a custom context menu, with no security warnings whatsoever.

https://specterops.io/blog/2026/05/07/shift-happens-uncovering-two-built-in-command-injections-in-windows-context-menus/

Using the Microsoft Graph PowerShell SDK to Update User Profiles

Tony Redmond walks through how to use the Microsoft Graph PowerShell SDK to add awards and certifications to Microsoft 365 user profile cards, a UX update Microsoft is now rolling out to tenants. The post covers New-MgBetaUserProfileAward and New-MgBetaUserProfileCertification, how to manage the various properties, and how the resulting data surfaces in OWA, the new Outlook, and Teams. Tony also gives some good context on Microsoft’s broader people platform initiative and the surprisingly rich set of resources you can now attach to a user profile, from anniversaries to languages to publications.

https://office365itpros.com/2026/05/08/user-profile-card-awards/

Microsoft DSC v3: Build and Deploy Classic Resources with ActiveDirectoryDsc

Michal Machniak has a phenomenal deep dive on using DSC v3 to deploy a full Active Directory environment from scratch using nothing but declarative YAML files. He walks through a two stage approach where the first stage uses ActiveDirectoryDsc/ADDomain to spin up the forest and promote the first DC, then the second stage uses Microsoft.DSC/Include to compose six smaller configurations covering the OU hierarchy, admin users, delegation groups, group membership, OU permission entries, and fine grained password policies. The post is loaded with working YAML examples, parameter file patterns for keeping secrets out of source control, and the actual dsc config commands to validate and apply each stage.

https://mmachniak.net/2026/05/06/dscv3-build-and-deploy-classic-resources-activedirectory-dsc/

From ISE Anxiety to VS Code Every Day with Paula Kingsley

Andrew Pla sits down with Paula Kingsley, an eight time Microsoft MVP for Exchange Server and self described happy generalist, for a wide ranging conversation about her tech career and the long delayed jump from ISE to VS Code. Paula admits she put off the switch for as long as possible, and her advice for anyone in the same boat is refreshingly simple: just open VS Code and leave it open. The episode also covers why being a generalist is undervalued, the importance of building yourself an escape route with WhatIf and ShouldProcess, and the very real difference between Get cmdlets and Set cmdlets when your afternoon is on the line.

PowerShell Universal Forum Moves to Devolutions

Adam Driscoll announced this week that the Ironman Software forum is closing and migrating to the Devolutions forum starting Monday, May 11. All existing PowerShell Universal discussions and threads will be moved over and any new posts will need to be made directly on the Devolutions side, which means creating a free Devolutions account if you do not already have one. The migrated posts will appear anonymously at first but you can claim your content once your account is set up. Worth knowing about if you have ever posted there.

https://forums.ironmansoftware.com/t/heads-up-were-moving-to-the-devolutions-forum/13316

Announcing Native PowerShell Tooling for ReFS Snapshots

Jeffrey Woolsey announced ReFSSnapshots, a new open source PowerShell module from Microsoft that wraps the existing refsutil streamsnapshot command line utility in proper cmdlets with pipeline support and consistent error handling. ReFS has long supported stream level snapshots for point in time capture of individual files or streams rather than full volumes, but until now you had to drive it through the command line tool. If you are already using ReFS for resilient storage on Windows Server or client, this makes integrating snapshots into your existing PowerShell workflows significantly easier, and the GitHub repo includes good examples for pre change snapshots, comparison workflows, and scheduled maintenance.

https://techcommunity.microsoft.com/blog/filecab/announcing-native-powershell-tooling-for-refs-snapshots/4516377

How to Install the New Microsoft Entra ID Module

Patrick Gruenauer has a quick reference for installing the new Microsoft.Entra PowerShell module for managing Microsoft 365 from PowerShell. The whole setup is essentially Install-Module, Connect-Entra, and you are off to the races. Handy bookmark if you are still migrating scripts away from the older AzureAD or MSOnline modules and want a clean starting point.

https://sid-500.com/2026/05/06/powershell-how-to-install-the-new-microsoft-entra-id-module/

ExcelFast v0.0.1-alpha14 Released

Justin Grote pushed a new alpha release of ExcelFast, his high performance PowerShell module for importing, exporting, and manipulating Excel files. If you are still doing Excel work with ImportExcel or wrestling with COM automation, this is worth tracking as an alternative built for speed.

https://github.com/JustinGrote/ExcelFast/releases/tag/v0.0.1-alpha14

Upcoming Events

PowerShell UserGroup InnSalzach: Your Graph Apps Are Over-Privileged, Let’s Fix That with PowerShell

The PowerShell UserGroup Inn-Salzach is hosting Morten Mynster on May 14 from 8PM to 9PM CET for an online session on auditing and right sizing Microsoft Graph application permissions with PowerShell.

https://www.meetup.com/de-de/powershell-usergroup-inn-salzach/events/314638631/

PSConfEU 2026 June 1-4, 2026 in Wiesbaden, Germany

https://psconf.eu/

PowerShell 7.7.0-preview.1 Released

The first preview of PowerShell 7.7 dropped this week and it is a substantial release with a long list of community contributed improvements. On the cmdlet side, highlights include an ExcludeProperty parameter for the Format cmdlets, an Extension parameter for Join-Path, a new ToRegex method on WildcardPattern, improved tab completion for PSBoundParameters switch cases and access patterns, and a DSC v3 resource for PowerShell profiles. Several long standing annoyances around explicit switch false parameter handling get fixed across multiple cmdlets including Where-Object, Get-Uptime, New-Guid, Get-Random, and Test-Connection. Export-Csv gets a quality of life fix making Append and NoHeader mutually exclusive, and NoTypeInformation is now marked as an obsolete no-op with IncludeTypeInformation becoming the default behavior.

PSFeedbackProvider and several other experimental features also graduate to stable in this release. There is a new PSApplicationOutputEncoding variable, AppContainer support lands in the engine, and the update notification now delays by a week to ensure all packages are available before nagging you. On the breaking changes side, ValidateNotNullOrEmpty is now enforced on the -Property parameter of Format-Table, Format-List, and Format-Custom. And yes, this is the first release shipping as MSIX rather than MSI on Windows, so if you missed last week’s item from Harm on that change, now is a good time to go back and read it.

https://github.com/PowerShell/PowerShell/releases/tag/v7.7.0-preview.1

DSC v3.2.0 Released

DSC v3.2.0 hit general availability this week and it is a substantial update. New built-in Windows resources cover services, optional features, features on demand, firewall rules, and a full suite of SSH server configuration resources, all ready to use without additional installation. Version pinning lands in this release, meaning you can now lock a configuration document to a specific DSC version and pin individual resources to version ranges, which addresses a real gap for anyone running configurations across environments with different resource versions. The expression language gets lambda expressions with map and filter functions, dataUri functions, and reference usage inside copy loops. Adapter improvements include automatic conversion of PowerShell Write-* streams to DSC traces, which is a nice quality of life addition for resource authors. The experimental Bicep integration via gRPC is also included, letting Bicep orchestrate DSC resources directly without going through ARM. And an experimental PowerShell discovery extension now lets DSC find resources defined in PowerShell modules that are not traditional PSDSC resources. Big release with a lot of community contribution behind it.

https://devblogs.microsoft.com/powershell/announcing-dsc-v3-2-0/

From Event Logs to AI Workflows with Lucas Allman | The PowerShell Podcast E225

Lucas Allman joins Andrew Plaw for a conversation that starts with practical beginner wins and builds into bigger questions about AI, learning, and career growth in IT. The episode covers hands-on use cases like using Get-WinEvent to filter event logs and reusing XPath filters from Event Viewer inside PowerShell scripts, writing full functions directly in the interactive terminal and saving them with a custom helper so good code survives the session, and the experience of speaking at PowerShell Summit for the first time.

The AI discussion is one of the better ones out there right now, with Lucas making a clear case for using it as a collaborator to offload repetitive work and learn faster rather than a replacement for the judgment and critical thinking that still matter (which I totally agree with). Impostor syndrome - which we talk about below with Robert’s post - keeping up with change, and why curiosity and community remain as important as technical skill all get a moment too.

Legacy: My First Microsoft MVP Summit

Robert Bogue has a lovely short piece reflecting on attending his first MVP Summit over 20 years ago, where he sat in the back of a room and watched Jeffrey Snover present what would eventually become PowerShell, then still called Monad. He writes honestly about the impostor syndrome he felt that day and how Snover’s vision for a consistent verb noun command language stood out as the single clearest piece of thought leadership from the entire event. Worth a few minutes of your time as a reminder of where all of this came from. I actually felt the same way when I was out in Redmond.

https://thorprojects.com/2026/04/30/legacy-my-first-microsoft-mvp-summit/

PowerShell Summit After Dark | The PowerShell Podcast

Andrew Plaw recorded a couple of bar session conversations at PowerShell Summit for this special edition of the podcast. First up is Josh Dearing, known as Fortress in the PDQ Discord, talking about his journey from batch scripts to publishing modules, his first Summit experience, and why seeing speakers fail and push through was one of the most motivating things he took away from the week. The second conversation is with Jeff Wlaw, a long time PowerShell user attending his first in person Summit, reflecting on Jeffrey Snover’s session, the value of outside perspective in IT careers, and a genuinely good tangent on directness, honesty, and why being willing to be wrong is actually a sign of intelligence. Loose, honest, and exactly what you would hope a bar session podcast sounds like.

Microsoft Defender for Endpoint in Depth: 2nd Edition

Ru Campbell announced that the second edition of Microsoft Defender for Endpoint in Depth is now available for pre-order, shipping in May. Written alongside Paul Snow and Ian Hoyle, the new edition adds three fresh chapters covering tuning and situational optimizations, mobile threat protection, and safer production rollouts, with every other chapter refreshed to reflect the three years of Defender changes since the first edition. If you are serious about MDE in your environment this has been one of the most recommended practical guides in the space and the update sounds substantial.

https://www.amazon.com/dp/1837026114

PowerShell in the Browser: Safe Sandboxes and Interactive Learning

James Brundage presented at the Research Triangle PowerShell Users Group on two projects he has been building: Reptile, a browser based PowerShell REPL built on data language mode that lets you run only the commands you explicitly whitelist, and Turtle, an interactive graphics programming environment layered on top of it. The safety story is genuinely clever, data language mode has been in PowerShell since V2 and makes it impossible for a user to run commands you have not approved, which means you can hand this to a complete beginner or even a kid and not worry about them accidentally doing something destructive. The demos are fun, including drawing 100 random turtle graphics in under 20 seconds and an accidental karaoke server, but the underlying architecture is worth understanding if you have ever wanted to expose PowerShell functionality through a browser interface without the usual security headaches.

Celebrating 250 PowerShell Posts

Harm Veenstra hit a milestone this week with his 250th post on PowerShellIsFun, four years after starting the blog in April 2022. He shares some honest reflections on writer’s block, the fear of posting things others have already covered, and how the PowerShell community’s welcoming nature made all of it worthwhile. A well deserved milestone from someone who consistently puts out quality content every single week. Harm is a great guy.

https://powershellisfun.com/2026/04/24/celebrating-my-250-powershell-related-posts/

April 2026 PowerShell Potluck with Jeff Hicks

Jeff Hicks wraps up April in his newsletter with a few things worth checking out. The main discovery this month is the TextMate module, a syntax highlighting wrapper that makes viewing script files in the console genuinely pleasant, with support for dozens of languages, multiple themes, and paging for longer files. Jeff also shares a moment from PowerShell Summit that clearly meant a lot to him: he received the Don Jones PowerShell Community Leadership Award, nominated by members of the community. Well deserved. He closes with this month’s scripting challenge, which asks you to use Get-NetAdapterStatistics to build a live updating display using either Write-Progress or the pwshSpectreConsole module.

https://buttondown.com/behind-the-powershell-pipeline/archive/april-2026-powershell-potluck/

Office 365 for IT Pros May 2026 Update

Tony Redmond’s monthly roundup covers Microsoft’s upcoming Modernized Change Management system, which promises better written message center posts, an MCP server for querying updates, and a new frontier tier for tenants wanting earlier feature access. Other notable items include the ability to change a meeting organizer via Exchange Online PowerShell, recently used Teams emojis syncing across devices, and Copilot Chat gaining access to shared mailbox content for licensed tenants. The Automating Microsoft 365 with PowerShell eBook is also updated to version 23 this month for subscribers.

https://office365itpros.com/2026/05/01/office-365-for-it-pros-may-2026-update/

Upcoming Events

PSConfEU 2026 June 1-4, 2026 in Wiesbaden, Germany

https://psconf.eu/

PowerShell 7.6.1 Released with .NET SDK 10 Update

The PowerShell team has shipped 7.6.1, a maintenance release that refreshes the runtime to .NET SDK 10.0.202. I noticed the update now delays its upgrade notification by a full week so every package is live before users get nudged, and the release also folds in a PSNativeCommandArgumentPassing test fix alongside general cmdlet improvements. Binaries are published across Windows, Linux, and macOS on x64, arm64, and arm32 architectures, with LTS packages rolling out in parallel.

https://github.com/PowerShell/PowerShell/releases/tag/v7.6.1

PowerShell Scanner Now Live in PDQ Connect

PDQ announced on this week’s PDQ Live that the long awaited PowerShell scanner has officially landed in PDQ Connect, letting you run PowerShell queries against your fleet and pull real data back for reporting, automation, and the environment questions that have gone unanswered for too long. I watched the stream and the developers who built it joined to walk through what is under the hood, and the team also showcased several community built scanners solving real world problems. If you have been waiting for your scripts to have a proper home inside Connect, this is the release to check out.

Check Mail Records with the DomainHealthChecker PowerShell Module

Harm Veenstra has a helpful walkthrough of the DomainHealthChecker module from Martien van Dijk, which pulls SPF, DKIM, DMARC, BIMI, DNSSEC, and MTA-STS records for any domain you point it at. I like that the Invoke-SpfDkimDmarc cmdlet bundles the major checks into a single call and accepts a file of domains for bulk validation, making it a fast fit for migration prep or security audits. The module installs straight from the PowerShell Gallery or via PSResourceGet, and Harm walks through each cmdlet with real output so you can see exactly what to expect before running it against your tenant.

https://harmveenstra.nl/2026/04/17/check-mail-records-using-the-domainhealthchecker-powershell-module/

PowerShell Universal 2026 Part 5: Creating an Endpoint That Accepts a Body

JackedProgrammer continues the PowerShell Universal for Beginners series with a walkthrough on building a GET endpoint that accepts a JSON body instead of a query string, which is a cleaner and generally more secure pattern for filtering data against an API. I appreciated the practical touch of starting with a simple return of the input data to confirm the body is being read correctly, then layering in Get-ADUser logic, input validation using Get-Member to check for required properties, and a proper try catch block to return clean error objects when things go sideways. The demo also drives home why returning well structured JSON messages matters, since the consumers of your endpoint might be calling it from Python, JavaScript, or curl rather than PowerShell.

Entra and Microsoft 365 Could Improve License Reporting

Tony Redmond takes a hard look at the new License Usage Insights feature that landed in the Entra admin center on April 22, alongside the new dashboard card for licenses in the Microsoft 365 admin center. I share his frustration that the two admin centers cannot seem to agree on a single consistent story, with the Microsoft 365 dashboard reporting a user count that includes utility accounts like shared and room mailboxes and even claiming license totals that do not mathematically add up. Tony also points out that while the Entra insights are a welcome step, there is no way to click through to identify which account is actually using risk based conditional access, and no option to download the underlying data.

https://office365itpros.com/2026/04/24/license-insights/

PowerShell Resources Roundup from PDQ Live

Andrew Pla walked through a loaded list of PowerShell resources on this PDQ Live segment, spanning the essentials like Windows Terminal, VS Code, and PowerShell 7, alongside community favorites like Import Excel which he credits with changing lives once admins realize they can generate real spreadsheets without Excel installed. Where the episode really sharpened up was the security tooling section, covering Locksmith for auditing Active Directory Certificate Services, Maester for running baseline checks against your Entra tenant, and Morton’s Least Privilege MS Graph module for trimming enterprise app permissions down to only what the logs show they actually use.

Understanding the additionalProperties Property in Microsoft Graph PowerShell

Tony Redmond tackles one of those quirks that trips up every admin making the jump from Exchange Online or the old AzureAD module to the Microsoft Graph PowerShell SDK, which is the way cmdlets like Get-MgUserMemberOf and Get-MgGroupMember return a sparse set of strongly typed properties and stash everything else inside a catch all dictionary called additionalProperties.

https://office365itpros.com/2026/04/21/additionalproperties-property/

Upcoming Events

PSConfEU 2026 June 1-4, 2026 in Wiesbaden, Germany

https://psconf.eu/

Lightning Demos from PowerShell Summit

Andrew Plaw hosted a live PowerShell Wednesday lightning demo session from PowerShell Summit featuring a great mix of quick fire projects. Highlights included James Brundage’s Reptile module for running PowerShell in a safe constrained web REPL, Justin Grody’s clever approach to shipping telemetry from any script to Azure Application Insights using a DLL already bundled with PowerShell 7, and Lucas Almond’s custom PS1XML format file that makes Intune managed device objects far more readable with color coded compliance states and clickable portal links. Morton Minster also joined remotely to debut his Andrew Pla module on the PowerShell Gallery, which is exactly what it sounds like and absolutely should not exist.

PowerShell MSI Package Deprecation starting with the new preview updates (v7.7 Preview 1)

Harm Veenstra has a quick but important heads up for anyone managing PowerShell deployments at scale. Starting with the 7.7 Preview 1 release, Microsoft is dropping the MSI installer in favor of MSIX, and the transition comes with some meaningful gaps right now, most notably that remoting and execution from system level services like Task Scheduler no longer work with NT AUTHORITY\SYSTEM or Group Managed Service Accounts. Microsoft says they are actively working on those scenarios, and existing releases including 7.6 will continue to get MSI packages, but if you are planning ahead for 7.7 GA this is worth knowing about sooner rather than later.

Harm’s piece: https://powershellisfun.com/2026/04/10/powershell-msi-package-deprecation-starting-with-the-new-preview-updates-v7-7-preview-1/

Here is a link to the Microsoft release about this: https://devblogs.microsoft.com/powershell/powershell-msi-deprecation/

PowerShell Wisdom from 35 Years in the Trenches with Jeff Hicks. The PowerShell Podcast E222

My good friend Andrew Plaw sits down with Jeff Hicks right before PowerShell Summit for a conversation that covers a lot of ground, from the organic origins of the Summit community back in the early days when laptops started opening in hotel lobbies, to how AI is likely to reshape the next decade of PowerShell careers, to what it actually means to learn PowerShell the right way by focusing on the core language and paradigm before diving into any specific technology stack.

Manage Microsoft 365 Groups Using a PowerShell Script

The AdminDroid team has published a solid Microsoft 365 group management script that covers 19 actions through a single tool, handling everything from creating groups and enabling Teams to assigning and removing licenses, bulk adding members, and restoring deleted groups. If you are managing groups at any kind of scale and still doing it through the portal, this is worth a look.

https://o365reports.com/microsoft-365-group-management-using-powershell/

Writing PowerShell for the Eventually Consistent Entra ID Database

Tony Redmond has a practical post expanding on a Microsoft developer blog about Entra ID’s eventually consistent architecture and what that means for your PowerShell scripts. The core advice is sensible: use delegated access with the ConsistencyLevel parameter when consistency matters, trust write responses instead of reading back to verify them, create fully populated objects in a single command rather than multi-step create-read-update workflows, use the identifiers returned by creation cmdlets rather than re-querying for them, and add retry logic with a brief pause when transient read failures do occur.

https://office365itpros.com/2026/04/13/eventually-consistent-entra-id/

REW-EQ-CopyPaste-Assistant

Ivan Bakhmutov has a handy open source utility called REW-EQ-CopyPaste-Assistant that takes the tedium out of transferring EQ filter settings from Room EQ Wizard into your DSP software. The tool runs in the background, watches your clipboard for copied EQ filter data, and then automates the keystroke and mouse click sequences needed to paste the values into your DSP app’s filter bands. It uses a JSON profile system so you can define sequences for different DSP software, and the repo already includes tested profiles for a wide range of brands including Musway, Zapco, Behringer, Powersoft, Goldhorn, and many others.

https://github.com/IvanBakhmutov/REW-EQ-CopyPaste-Assistant

Upcoming Events

PSConfEU 2026 June 1-4, 2026 in Wiesbaden, Germany

https://psconf.eu/

Bart Pasmans has a fun walkthrough on building a PowerShell code reviewer that audits your scripts against your own organization’s coding standards using Azure OpenAI and Azure AI Search. The core idea is RAG, where your guidelines live in a Markdown file in blob storage, get vectorized and indexed by AI Search, and then GPT-4o uses them as its source of truth when reviewing code rather than just guessing at generic best practices. The end result is a simple PowerShell script that takes any local ps1 file, ships it to the cloud, and gets back cited feedback based on your actual rules.

https://bartpasmans.tech/powershell-rag-bring-your-own-guidelines-to-ai/

Leverage User and Group Assignments to Limit User Access to Apps

Tony Redmond has a useful follow up piece on locking down Entra ID applications, this time focusing on user and group assignments as a way to restrict who can actually use an app. The idea is simple: when assignments are in place, only the people you explicitly grant access to can use the application, which is a solid control for admin tools and anything else that should not be freely accessible across the tenant. Tony walks through the PowerShell to add user and group assignments via the Graph SDK, retrieve the current assignee list, remove assignments, and add the HideApp tag to keep apps from cluttering users’ My Apps screens. Worth bookmarking if you are working on tightening up app governance in your tenant.

https://office365itpros.com/2026/04/10/user-and-group-assignments/

Building Beautiful Terminal UIs in PowerShell 7 with Jeff Hicks

Jeff Hicks joined my good friend Andrew Pla on PowerShell Wednesday to walk through his new PS2ETools module, a collection of sample terminal user interfaces built on the TerminalGUI library that you can use as starting points for your own TUI projects. Jeff demos everything from a basic hello world layout to a process viewer, a service browser with CSV export, a remote computer status monitor with auto refresh, and an MP3 player with a menu and progress bar, all built entirely in PowerShell. The session also covers the practical mechanics of getting started including downloading the required assemblies, handling scoping quirks, wiring up events, building tables, and the important principle of always getting your PowerShell commands working in the console before wrapping anything in a TUI.

Check PowerShell Scripts for deprecated Azure AD or MSOnline Cmdlets

Harm Veenstra over at PowerShellIsFun has a handy script that scans your PowerShell scripts for deprecated AzureAD and MSOnline cmdlets and tells you exactly what to replace them with and where. If you have a library of older scripts that still use the legacy modules, this is worth a look before Microsoft pulls the rug out entirely.

https://powershellisfun.com/2026/04/03/check-powershell-scripts-for-deprecated-azure-ad-or-msonline-cmdlets/

Intune Stack and the Art of Showing Up with Hailey Phillips. The PowerShell Podcast E221

Andrew Plaw sits down with returning guest Haley Phillips, Intune MVP and creator of Intune Stack, for a wide ranging conversation that covers far more than just PowerShell. Haley gives an update on Intune Stack, her CI/CD inspired project for managing Intune policy through promotion gates across dev, test, and prod groups using PowerShell and Graph API calls, which she will be presenting at PSConfEU.

Microsoft Defender Live Response - The last line of defence!

Rahul Jindal shares a great war story about recovering a device that had fallen into a nearly unrecoverable state after a failed Intune reset deleted it from both Intune and Entra ID, taking the LAPS password and BitLocker recovery key with it. With no trust relationship, no admin access, and no way to retrieve the recovery key through normal channels, he remembered the device was still onboarded to Microsoft Defender for Endpoint, which uses its own communication channel through the Sense service independent of Entra ID join state.

https://rahuljindalmyit.blogspot.com/2026/04/microsoft-defender-live-response-last.html

MicrosoftFabricMgmt - The PowerShell module to rule Fabric - Jess Pomfret & Rob Sewell

Jess Pomfret and Rob Sewell did a deep dive session on the MicrosoftFabricMgmt PowerShell module, an officially Microsoft hosted but community contributed open source module that lets you manage Microsoft Fabric workspaces, items, and permissions through PowerShell instead of the portal. The talk covers what Fabric actually is for those who have not encountered it yet, why the click first nature of the platform creates governance nightmares at scale, and how the module handles the ugly realities of working against the Fabric API including token expiration, throttling with built in retry logic, and GUID heavy responses that get resolved to human readable names via a PSFramework powered cache. Rob and Jess also showed how they used Claude rather than Copilot to do the heavy lifting when refactoring the module, and teased an MCP server for Fabric that they hope to have ready for PSConfEU. A great video that just dropped this morning!

Chatbots: Unsafe at Any Speed

Jeffrey Snover is back with a follow-up to his AI safety post, and this one is even sharper. His argument is that general purpose chatbots are fundamentally unsafe not because the models are bad but because "answer whatever the user asks" is an infinite goal, and an infinite goal produces an infinite loss space that no amount of content filtering or safety patching can ever fully defend. He traces the root of the problem back to Microsoft's Tay experiment in 2016, which he calls the mother bug, and draws a direct parallel to Ralph Nader's argument that the Corvair was not a driver problem but a design problem.

https://www.jsnover.com/blog/2026/03/30/chatbots-unsafe-at-any-speed/

Upcoming Events

PowerShell + DevOps Global Summit 2026 April 13-17, 2026 in Bellevue, WA - The premier PowerShell community event returns this spring!

https://www.powershellsummit.org/

PSConfEU 2026 June 1-4, 2026 in Wiesbaden, Germany

https://psconf.eu/

The PowerShell team published a candid postmortem on why 7.6 shipped later than planned, and it is worth a read if you were wondering what happened. The short version is that a compliance requirement introduced late in the cycle forced a complete replacement of the packaging toolchain for non Windows platforms from scratch, which cascaded into validation delays across multiple platforms and architectures, a holiday freeze that blocked publishing to PMC, and coordination gaps that made it hard to track risk and escalate early. To their credit the team is not just explaining what went wrong but has already started fixing it, with explicit release ownership, structured tracking, a more consistent preview cadence, and a commitment to communicate timeline risks to the community earlier through the PowerShell repository discussions.

https://devblogs.microsoft.com/powershell/powershell-7-6-release-postmortem/

Poking Around Until Something Breaks (And reporting it to MS) PowerShell Podcast E220 Morten Mynster

Andrew Plaw sat down with returning guest Morton Minster for a genuinely fun conversation about a year of remarkable growth that took Morton from publishing his first PowerShell module to landing a cybersecurity consultant role at a new firm, all without ever sending out a resume. Morton walks through his three public modules including the standout least privilege MS Graph tool that audits app registrations and service principals for over-permissioned Graph access, and he shares the story of discovering a security vulnerability in the Microsoft email developer dashboard where publicly registered adaptive card providers were inadvertently exposing target URLs including logic app signature keys to anyone with a tenant. Microsoft fixed it just before Christmas. The broader conversation covers APIs, the value of learning in public, the honest tradeoffs of leaning too hard on AI before you have a real foundation, and the very memorable term “slop cannon” to describe what happens when someone without that foundation starts generating code they cannot read or debug.

Bulk Convert External Users to Internal Users Using PowerShell

The AdminDroid blog has a practical walkthrough for something that comes up more than you might expect: converting guest users in Microsoft Entra ID into full internal users without deleting and recreating accounts. The native Entra portal supports this but only one user at a time, so they built a PowerShell script that handles bulk conversions via CSV, auto-generates UPNs and passwords at scale, and exports a password-protected log file for auditing. Group memberships, permissions, and activity history all survive the conversion intact, which is the whole point, though they do note a few things to watch for afterward like dynamic group membership changes and profile attributes that may still reflect the old guest account values.

https://o365reports.com/convert-external-users-to-internal-users-in-bulk-using-powershell/

Harm Veenstra’s MVP Summit Breakdown

Harm Veenstra has a fun recap of his second MVP Summit in Redmond, and it is the kind of post that makes you wish you were there (which I was, but didn’t do this great of a recap haha). The week was packed with NDA sessions on the Microsoft campus, a tour of the Microsoft Studios, a visit to the Xbox Studio including a genuinely impressive silent room, a PowerShell Ask Me Anything session, and a closing keynote from Mark Russinovich. Harm also attended the Northwest System Center User Group event on Friday just down the road, caught sessions on OSDCloud, PowerShell, and Intune, and wrapped up with a community dinner. Thde highlight of the whole trip might be that he is now the proud new keeper of a 3D printed Clippy chain that Dan Rey has been passing around the community.

https://powershellisfun.com/2026/03/23/mvp-summit-2026/

Your MS Graph App Has Too Much Access. Let’s Fix It with PowerShell

Morton Minster joined PowerShell Wednesday to do a live walkthrough of his Least Privilege MS Graph module, which audits all the app registrations, managed identities, and service principals in your tenant and compares the permissions they actually used against the permissions they have assigned. The setup involves enabling Microsoft Graph activity logs, routing them to a Log Analytics workspace, and giving the module read access to both, after which a single command produces an HTML report showing excessive permissions, optimal permission recommendations, throttling stats, and a list of apps with zero activity over your chosen timeframe. That last category is where the easy wins live since Morton’s sample report showed over 1,300 out of 1,600 apps with no activity at all, which is a significant attack surface most people have no visibility into. There is also a GitHub Actions workflow included so you can run the scan on a schedule and track changes over time without thinking about it.

How to Report Entra ID Group Insights

Tony Redmond takes a look at Entra ID Group Insights, a new preview feature that quietly appeared in the Entra admin center in early February without any formal announcement or documentation. The feature surfaces things like groups without owners, expired groups, and missing sensitivity labels, which are all useful but nothing you could not already find with a few lines of PowerShell. Tony’s main gripe is that the current output displays GUIDs instead of group names, which is not exactly human friendly. The more interesting part of the post is that he figured out the underlying Graph endpoint powering the feature and wrote a script that pulls the same data, resolves the GUIDs to actual group names, adds owner information, and produces a proper HTML and CSV report. The script is available in the Office 365 for IT Pros GitHub repository if you want to build on it.

https://office365itpros.com/2026/03/31/entra-id-group-insights/

PowerShell in 100 Sekunden

Andreas Dieckmann, has a great new video - here is his description from LinkedIn:

Hey folks, I created a "PowerShell in 100 Seconds" video as a short introduction to PowerShell. For most members of this group, it won't contain much news, but still might be interesting or entertaining. Or maybe something so share with someone where you want to spark some interest about PowerShell :)
The video has two real audio tracks (both actually spoken by me), no YouTube Auto-Dubs nor AI generated. You can choose between German or English in the YouTube player settings.

Pretty PowerShell Presentation

Jeff Hicks spent this issue of Behind the PowerShell Pipeline exploring how to make JSON output actually readable in the console using the pwshSpectreConsole module. The star of the show is Format-SpectreJson, which takes plain monochromatic JSON output and renders it with syntax highlighting, customizable colors for every element type from braces to member names to numbers, and even italic styling if you want it. Jeff goes a step further by wrapping the output in a Format-SpectrePanel to give it a titled border, and from there he starts building his own Show-JsonFile tooling that adds line numbers on top of everything else. If you are not already running pwshSpectreConsole, this is another good reason to install it.

https://buttondown.com/behind-the-powershell-pipeline/archive/pretty-powershell-presentation/

Upcoming Events

PowerShell + DevOps Global Summit 2026 April 13-17, 2026 in Bellevue, WA - The premier PowerShell community event returns this spring!

https://www.powershellsummit.org/

PSConfEU 2026 June 1-4, 2026 in Wiesbaden, Germany

https://psconf.eu/

PowerShell Community Call - March 19th, 2026

The March 2026 PowerShell Community Call kicked off with Sydney Smith delivering updates on PS Resource Get and the Microsoft Artifact Registry. The big news is that a .NET library for ORAS is now available, meaning the upcoming 1.3 release will let you use any OCI container registry, not just Azure specific ones (Sydney seemed particularly excited about GitHub container registries). Sydney also committed to publishing a blog post before the April call that will lay out the current package management landscape and give enterprise customers clearer guidance on timelines for the transition away from PS Gallery as the default source.

Steve Lee then demoed DSC v3 Preview 13, which shipped roughly half an hour before the call began. The preview introduces a new Service resource and an Optional Feature List resource, both written in Rust for speed, and Steve walked through live demos of getting, testing, and setting service states. He was very upfront that these are experimental 0.1 versions and actively invited community feedback on design decisions like whether a property should be called “name” or “feature name,” which is the kind of collaborative development that makes the PowerShell ecosystem genuinely fun to follow.

The call wrapped up with two crowd pleasers. Sean Wheeler showed off his Release Info module, which pulls data from sources like endoflife.date, GitHub, and packages.microsoft.com to give you a unified view of PowerShell release status and OS support timelines (the kind of tool you build for yourself at 2am and then realize you should probably share). Thomas Nieto then demoed a full LCM and pull server replacement built on DSC v3, complete with a Blazor UI, compliance dashboards, drift reporting, a scoped parameter system, and even composite configurations for managing multiple team responsibilities on a single node. Jason Helmick also noted that PowerShell 7.6 went GA and that RHEL 10 and Debian 13 RPM packages are nearly ready, with a minor pipeline snag being resolved within a few days.

Chris Thomas sits down with Andrew Pla to talk

In this episode of the PowerShell Podcast, Andrew Plaw sits down with Chris Thomas, someone I know well from the Michigan K12 IT world (actually a major influence in my early PowerShell years), whose career arc from high school intern to Endpoint and Cloud Systems Architect at an ISD serving six school districts will feel deeply familiar to anyone in our space. The conversation covers the profound influence Don Jones and his “Be the Master” philosophy had on Chris, alongside some genuinely great real-world PowerShell war stories including automating Apple ID creation for 1,200 iPads, building a full identity management solution from scratch, and using a DHCP scope crawling script to help track down a student who was DDoSing the district and attempting Bitcoin extortion with the FBI eventually getting involved. Chris and Andrew also dig into the PowerShell App Deployment Toolkit, the challenge of migrating from the ISE to VS Code, and the recurring theme that the hardest part of growing in any technical community is simply taking that first step and putting yourself out there, something Chris continues to model through his user group leadership and regional K12 conference presentations.

PowerShell v7.6 LTS Release and why it matters

Harm Veenstra has a quick but useful breakdown of the PowerShell 7.6 LTS release, covering what LTS actually means, why you should bother upgrading, and what is new in the release. Highlights include updates to PSReadLine and PSResourceGet, tab completion improvements, new parameters added to several existing cmdlets, and a handful of breaking changes worth knowing about before you upgrade. If you are still on 7.4, now is a good time to make the move.

https://powershellisfun.com/2026/03/20/powershell-v7-6-lts-release-and-why-it-matters/

PowerShell to MCP in 30 Seconds: The “Zero-Boilerplate” Guide for Architects

Doug Finke did a live demo showing how to turn a PowerShell function into a working MCP server tool in about 30 seconds using his PSMCP server module, with VS Code Copilot acting as the client. The core idea is elegant: wrap your existing PowerShell functions, let the module extract the names, parameters, and help documentation, and the AI client can discover and call those functions naturally through conversation. Doug also touched on important practical considerations like context bloat from too many tools, the security risks of running untrusted MCP servers, and the value of wrapping built-in cmdlets to constrain what the AI can actually do with them.

Jeffrey Snover on AI Safety

Jeffrey Snover attended the STAMP Safety Design Workshop at MIT this week and came away with a perspective worth paying attention to. His core argument is that “AI safety” is a category error because AI is not a system, it is a component of a system, and safety is a property of systems, not components. The same way a hard disk is neither safe nor unsafe on its own, an AI model only becomes safe or unsafe based on how it is deployed and what guardrails the surrounding system provides. Jeff lays out a practical engineering playbook for building safe systems that include AI components, while pushing back hard on the idea that we should wait for someone to declare a model certified and safe before proceeding. Stop waiting for AI to be safe, he says. Start building systems that are.

Building Cross-Platform GUIs with PowerShell and GliderUI

Andrew Plaw and Josh Hendris spent a PowerShell Wednesday session exploring Glider UI, a cross-platform GUI framework for PowerShell built by community legend MDGRS that uses Avalonia as its rendering backend. The big appeal here is that it sidesteps the classic threading nightmare of Windows Forms and WPF by running the UI as a separate process that PowerShell communicates with, meaning your terminal stays interactive while the window is open. They walked through several examples including input controls, a progress bar demo they gleefully sabotaged with a five minute sleep at 95 percent completion, and a quick random name picker Josh built by hacking up the data grid example. The project is still in the prototyping phase so they hit a few rough edges, but the data grid support alone makes it worth watching given that it is something the similar WinUI Shell project currently lacks.

The Sad State of Microsoft Graph and Other APIs

Tony Redmond has a blunt piece on the frustrating state of the Microsoft Graph API, and it is worth a read if you have ever wrestled with its inconsistencies. The complaints from MVPs are familiar ones: missing or inconsistent API coverage across workloads, beta APIs that have been sitting in beta for years, an underfunded Microsoft Graph PowerShell SDK with a growing bug backlog, and the ongoing assembly clash nightmare between the SDK and the Exchange Online module. Tony does not pull punches on the likely cause either, pointing to Microsoft’s Copilot obsession as the thing quietly draining engineering resources from everything else. Definitely an interesting read.

https://office365itpros.com/2026/03/18/microsoft-graph-issues/

Upcoming Events

PowerShell + DevOps Global Summit 2026 April 13-17, 2026 in Bellevue, WA - The premier PowerShell community event returns this spring!

https://www.powershellsummit.org/

PSConfEU 2026 June 1-4, 2026 in Wiesbaden, Germany

https://psconf.eu/

Damien Van Robaeys has an interesting blog about how to automate the backup and accessibility of Intune scripts by syncing them directly to a SharePoint site. While managing Intune environments in 2026, he developed a streamlined Azure Automation runbook that exports both platform and remediation scripts into organized folders and summary CSV files. It’s a practical solution for teams who want to keep their script inventory up-to-date and easily viewable without constantly diving into the Intune portal.

https://www.systanddeploy.com/2026/03/automatically-export-your-intune.html

PowerShell Tips and Windows Shortcuts

Andrew Plaw from PDQ has a great video about boosting productivity through essential PowerShell features like PSReadLine and custom Windows Run dialog shortcuts. While demonstrating at a PDQ Live session in 2026, he explains how to use Ctrl+Space for advanced tab completion, F1 for context-sensitive help, and how to add a custom folder to the Windows System Path to launch any application instantly via the Win+R dialog. It is a fast-paced guide designed for both beginners and experienced sysadmins who want to minimize mouse usage and master their command-line workflow.

Automating Microsoft 365 with PowerShell Update #22

Tony Redmond has a great article about the March 2026 release of the PowerShell eBook update, which focuses on Exchange Online RBAC for Azure Automation and deep dives into Microsoft Graph navigable properties. While managing the Office 365 for IT Pros ecosystem in 2026, he highlights the critical additions to the Graph SDK and addresses the growing challenges of maintaining automation quality amidst the heavy industry shift toward AI resources.

https://office365itpros.com/2026/03/20/automating-microsoft-365-ps22/

AI Benchmarks Are Rigged — So I Built My Own in PowerShell

Doug Finke has a great video about his PSAI suite PowerShell module which allows users to run standardized benchmarks across over 15 different AI providers simultaneously. While navigating the rapidly shifting AI landscape in early 2026, he developed this tool to move beyond “sensationalized” public benchmarks and provide developers with a way to test real-world instruction following, reasoning, and latency. It’s a powerful framework for anyone needing to objectively compare model performance or validate complex prompt systems within their own automation workflows.

Regular Expression Actions

Jeff Hicks has an interesting post about how to use anchors and other advanced regular expression techniques to refine data filtering in PowerShell. While exploring the nuances of “floating matches” in 2026, he demonstrates how to use the ^ and $ characters to precisely target strings that start or end with specific patterns, such as filtering service names or complex file lists. It is a helpful guide for scripters who need to move beyond basic matching to handle unstructured text data more effectively.

https://buttondown.com/behind-the-powershell-pipeline/archive/regular-expression-actions/

Start Small and Keep Building in PowerShell. The PowerShell Podcast E218 Mason Moser

Mason Moser has an interesting video about his journey from reading PowerShell in a Month of Lunches to presenting on the Vim text editor and working in risk and governance within the security industry. While navigating the early stages of his career in 2026, he emphasizes the importance of starting with small automation tasks, like daily file cleanup scripts, and leveraging the PowerShell community to overcome imposter syndrome. It is a motivating watch for beginners who might feel overwhelmed, as it highlights how consistent, small steps can eventually lead to complex tool-making and public speaking opportunities.

Automate Compromised Account Remediation

admindroid-community has a great article about a PowerShell script that automates eight critical security best practices for handling compromised Microsoft 365 accounts. It provides a single-click workflow to quickly disable users, reset passwords, and audit suspicious activities to ensure a consistent incident response.

https://github.com/admindroid-community/powershell-scripts/tree/master/Automate%20Compromised%20Account%20Remediation

Upcoming Events

PowerShell + DevOps Global Summit 2026 April 13-17, 2026 in Bellevue, WA - The premier PowerShell community event returns this spring!

https://www.powershellsummit.org/

PSConfEU 2026 June 1-4, 2026 in Wiesbaden, Germany - Call for speakers is now closed.

https://psconf.eu/

I had the great pleasure of sitting down with my friend, Andrew Pla, on the PowerShell podcast and had one of the best conversations I’ve had with anyone in a while. We talked about my Ghost security module, my augmentative and alternative communication app (AAC) called TapSpeak, and community.

One question I didn’t quite answer well, in my opinion, was what it all meant for me and what drives me to do so much for the community - not just the PowerShell community. Not to be a quotation book, but I really do believe in Simon Sinek’s sentiment that if we want to fast we go alone, if we want to go far, we go together. Simon’s line resonates with me because it isn’t just motivational poster material, it’s something I’ve actually lived. And the older I get, the more I understand why it’s true.

I build security tools and give them away for free. I coach kids’ baseball on weekends. I sit on a school board and a planning commission. I built TapSpeak so that kids who can’t speak have a voice, and I made it free because the families who need it most are often the ones who can least afford it. None of those things came with a salary and, frankly, most of them came with extra hours I didn’t really have.

People sometimes ask me how I do it all, but I think that’s the wrong question (like I said logistically - regimented calendar, disciplined execution is the answer to that). The better question is why, and the answer is pretty simple in that I’ve never built anything meaningful by myself.

Every skill I have was handed to me by someone who didn’t have to do it. Someone wrote the blog post I learned from or someone answered a forum question I posted at midnight. Someone gave me a shot when I was still figuring it out. The community I’ve benefited from my whole career was built by people who contributed without keeping score. I’m just paying into the same fund.

There’s also something I’ve noticed across every domain I work in: PowerShell, K12 tech, youth sports, municipal planning, special education. The people doing the most important work are almost never the ones with the most resources. School districts protecting kids’ data on shoestring budgets and parents coaching because no one else showed up. Families navigating AAC devices that cost hundreds or maybe thousands of dollars. If you have knowledge or skill that can change that equation and you don’t share it, that’s a choice with real consequences for real people.

I don’t think of volunteering as charity, I think of it as infrastructure (very much the IT brain of looking at this haha). The communities worth living in, the ones where kids thrive, where professionals grow, where people feel safe, don’t happen by accident. They’re the accumulated result of thousands of small decisions by people who showed up when they didn’t have to.

Going alone is faster. I get and love that; when I was at Amazon, we talked about having a bias for action which is truly valuable in business. But when going fast, I have to ask, fast toward what? I’d rather go somewhere worth being, and that means bringing people with me.

v7.5.5 Release of PowerShell

The latest stable release of PowerShell, which dropped just 16 hours ago, which introduces a variety of engine updates and cmdlet improvements designed to enhance cross-platform stability. This version specifically addresses critical fixes for SSH connectivity and script behavior, including:

• Engine Updates: Resolved issues with SSH connection path checks to ensure more reliable remote connectivity.

• Cmdlet Fixes: Improved handle management by closing pipe client handles after creating child SSH processes.

• Scripting Improvements: Fixed the progress preference variable within script cmdlets to ensure consistent UI feedback.

• Build & Infrastructure: Updated the environment to use the .NET SDK 9.0.312 and refactored various GitHub Actions for better CI/CD performance.

https://github.com/PowerShell/PowerShell/releases/tag/v7.5.5

They Don’t Need to Fire You

Jeffrey Snover has a great blog on how companies use a “playbook” of incremental benefit and pay cuts to force natural attrition and avoid the costs associated with formal layoffs. This strategy allows organizations to reduce headcount and lower the cost-per-employee without paying severance or increasing unemployment insurance taxes.

https://www.jsnover.com/blog/2026/03/11/they-dont-need-to-fire-you/

Monad to Millions - Celebrating Jeffrey Snover & the PowerShell Community

Heiko Brenn had a great a special live stream celebration honoring Jeffrey Snover and the global community that grew around the Monad manifesto. The stream reflects on the origins of PowerShell and features stories from community members whose careers and lives were shaped by the platform. Jeff talks about how PowerShell started with the realization that managing Windows is fundamentally different from managing Linux. While Linux is all about text files, Windows relies on APIs and objects. This led to the invention of the object based pipeline, a game changing approach that actually got stronger because of tough internal testing limits. Since the team couldn’t test every single command, they had to build a super reliable engine that could handle metadata, basically turning a technical hurdle into the platform’s biggest win.

The jump from a corporate tool to a global movement happened because of a sacred vow to users. The team promised that any time you spent learning PowerShell would pay off by making you more valuable in your career. Experts like Bruce Payette and Gail Colas talk about how this promise shifted their work away from what they call ClickOps (something I had never heard of before, or at least described that way), which is just tedious manual clicking, and into the world of automation. This didn’t just make things faster; it created a unique community where sharing a script became a way to show off your best ideas and help out people all over the world.

As the industry moves into the AI era, the community is seeing another big shift. Instead of replacing PowerShell, AI is acting like a power-up that helps people write complex code and Pester tests faster than ever. Check this one out of you haven’t already - it’s jam packed. YouTube above, Linkedin where I watched it here:

https://www.linkedin.com/events/monadtomillions-celebratingjeff7425468327407321088/

Creating New Entra ID Users the PowerShell Way

Dennis Johansson has a great article on how to use the Microsoft Graph PowerShell SDK to automate the way you create new user accounts in Entra ID. While most people might just use the standard commands, Dennis explains how to set up the SDK and connect using interactive login or managed identities while sticking to the rule of least privilege. He walks through the prerequisites you need to get started and shares a custom function called New-EntraUser that makes the whole process much smoother.

https://www.cloudidentity.se/blog/creating-new-entra-id-users-the-powershell-way/

How to get better with Graph API - Part one

Jan Bakker has a great article on how to master the Microsoft Graph API by using your browser’s developer tools to see what is happening behind the scenes. He explains that almost every action in the Entra or Microsoft 365 admin portals is actually a call to the Graph API. By opening the Network tab and filtering for web requests, you can inspect the exact data being sent and received during common tasks like creating a new user.

https://janbakker.tech/how-to-get-better-with-graph-api-part-one/

The Guy Who Invented PowerShell Is Blown Away By AI

Doug Finke has an interesting video featuring Jeffrey Snover, the inventor of PowerShell, who shares his perspective on how AI is fundamentally changing the way we approach technology and problem-solving. Snover explains that we are entering an era where your existing knowledge can actually become your enemy, as it often limits your understanding of what is now possible. He describes his own experience being blown away by the capabilities of tools like Claude 4.6 and how they have allowed him to make progress on complex projects without needing to spend weeks learning the underlying syntax.

Super Charging your Autopilot Testing with HyperPilot, Autopilot Import GUI and a PowerShell TUI!

Mark Orr has an interesting new article about moving away from the repetitive grind of physical device testing by using community-driven virtualization tools. He explains how testing Intune enrollment configurations, like Autopilot profiles or app deployments, can be supercharged by shifting to a purely virtual workflow using tools like HyperPilot to automate VM creation and the Autopilot Import GUI for a user-friendly registration process.

https://orr365.tech/super-charging-your-autopilot-testing-with-hyperpilot-autopilot-import-gui-and-a-powershell-tui-af44c7ed1bee

Getting Started With PowerShell Regular Expressions

Jeff Hicks has an interesting article on how to transition from basic wildcard comparisons to the much more powerful world of regular expressions in PowerShell. He explains that while the -Like operator is great for simple patterns using asterisks, the -Match operator opens up a granular level of string identification that can recognize complex data like Social Security numbers or email addresses. By learning the “foreign language” of regex, scripters can write significantly more efficient code and take full advantage of the $matches variable to extract exactly the data they need.

https://buttondown.com/behind-the-powershell-pipeline/archive/getting-started-with-powershell-regular/

Upcoming Events

PowerShell + DevOps Global Summit 2026 April 13-17, 2026 in Bellevue, WA - The premier PowerShell community event returns this spring!

https://www.powershellsummit.org/

PSConfEU 2026 June 1-4, 2026 in Wiesbaden, Germany - Call for speakers is now closed.

https://psconf.eu/

For the past few days, I’ve had the pleasure of attending Zero Trust World, a cybersecurity conference in Florida. ThreatLocker is a zero trust EDR/MDR platform that comprehensively locks down endpoints with a variety of strategies. Full disclosure, I am not being paid to write this; I’m just a huge fan.

ThreatLocker has rolled out some fantastic new features. The star of the show was their new Zero Trust Cloud Access, which basically acts as a high-speed broker for SaaS apps like Microsoft 365 and GitHub. Instead of the usual clunky VPN that tunnels everything, this system only routes the specific protocols you need, and it ties your identity to your actual hardware. This means even if a hacker manages to phish your password and MFA code, they’re still stuck because they don’t have your physical device or your face for the biometric check.

They also dug into Zero Trust Network Access (ZTNA), which is all about securing your local “vault” without leaving any doors open. This is a huge deal because you can now write policies that allow a specific app to talk to a database while explicitly blocking PowerShell from doing the same. It’s a clever way to stop “living off the land” attacks where intruders use your own admin tools against you. Plus, they’ve added a “Default Against Misconfigurations” (DAC) tool for Office 365 that constantly scans for security gaps, like accidental mailbox forwarding or disabled MFA, and gives you a simple score to see how you’re doing compared to everyone else. Check out the video to see how these new features work. There were many other great sessions that will published online soon.

I also ran into fellow Microsoft MVP and author of ScriptSentry, Spencer Alessi, who had a great Active Directory hacking lab. If you aren’t familiar with his work utilizing, check him out here:

http://spenceralessi.com/

https://github.com/techspence/ScriptSentry

Monad to Millions - Celebrating Jeffrey Snover & the PowerShell Community

Heiko Brenn will be hosting a special live-stream celebration honoring Jeffrey Snover, the creator of PowerShell, and the incredible community that turned a bold idea (Monad) into a global movement.

In this one-hour event, Jeffrey reflects on the origins of PowerShell, key moments along the journey, and what it means to see the community take ownership of the platform. Members of the PowerShell community share stories, laughs, and memorable moments, including some classic “Snover Stories” you won’t want to miss.

Whether PowerShell shaped your career, saved your weekend, or just made automation fun, this stream is about the people behind the shell, and the legacy they built together.

https://www.linkedin.com/events/7425468327407321088/

PowerShell is fun :) Over 1.000.000 views!

Harm Veenstra has a great post about celebrating one million site views and reflecting on a four-year journey of sharing PowerShell passion. The article highlights the importance of community involvement, Microsoft MVP recognition, and the support of sponsors like PDQ in reaching this significant achievement.

https://powershellisfun.com/2026/02/27/over-1-000-000-views/

Microsoft Graph Delta Query in PowerShell

Alf Løkken has an interesting article on performing stateful, incremental synchronizations of Entra ID resources using PowerShell. This guide demonstrates how to use delta tokens to retrieve only new or updated objects, effectively moving away from inefficient full-dataset snapshots.

https://alflokken.github.io/posts/graph-delta-queries/

Rename ComputerName Win32 App during Windows Autopilot

Manish Bangia has an interesting video about how to use a PowerShell script within a Win32 app to automatically rename computers during the Windows Autopilot process. This method bypasses the limitations of standard naming templates by using custom logic based on chassis type and serial numbers to ensure unique and descriptive hostnames.

Architecting Systems That Last - with Jeffery Snover

Hassan Habib has a good interview about the history of PowerShell and the architectural philosophies of its creator, Jeffrey Snover. The discussion covers the personal and professional risks Snover took to bring PowerShell to life, his transition from Microsoft to Google, and his insights on how AI is reshaping the landscape of system design and automation.

PowerShell Tools for PKI and Secure Boot. The PowerShell Podcast E216 Richard Hicks

Andrew Pla has an interesting interview with Microsoft MVP Richard Hicks about the complexities of ADCS security and PKI management. The discussion covers how simple certificate template mistakes can lead to full domain compromise, the upcoming expiration of crucial Microsoft UEFI certificates, and how specialized PowerShell modules like ADPrincipalCertificateKit are used by consultants to audit and secure enterprise environments.

Another Scary Microsoft Lawyers Incident or Don’t be on the Wrong Side of Antitrust

Jeffrey Snover has an interesting blog post about navigating a formal antitrust investigation triggered by a hostile competitor during the launch of PowerShell DSC. He describes how he relied on the “PerfMon pattern” to advocate for an open ecosystem and ultimately used a recording of his own technical presentation to prove his commitment to fair competition, clearing his name and highlighting Microsoft’s rigorous legal culture.

https://www.jsnover.com/blog/2026/03/03/another-scary-microsoft-lawyers-incident-or-dont-be-on-the-wrong-side-of-antitrust/

Azure Automation Modules Are A Mess… So Let’s Automate Them!

Adeel Automates has a great video about automating the management and deployment of PowerShell modules within Azure Automation Runtime Environments using REST APIs and VS Code. He demonstrates how to bypass manual portal updates by pulling modules directly from the PowerShell Gallery and storage accounts, including a clever trick for bulk-formatting large module lists for use in automation scripts.

Measuring KPIs like Response Times for Shared Mailboxes

Tony Redmond has an interesting article about how organizations can use Microsoft Graph and PowerShell to track responsiveness and customer interaction metrics within Exchange Online shared mailboxes. The post explores the technical challenges of identifying individual responders and measuring elapsed time between messages using conversation identifiers to gain insights into team productivity.

https://office365itpros.com/2026/03/05/shared-mailbox-kpi/

Microsoft Graph 5 - Send Email using PowerShell and Microsoft Graph

JackedProgrammer has a great video about using the Microsoft Graph SDK and PowerShell to automate sending emails, including how to handle file attachments. The tutorial demonstrates constructing the necessary JSON-like hash tables for the Graph API, converting files to Base64 strings for transmission, and provides a clear example of sending both plain text and PDF documents.

Even More PwshSpectreConsole Tools

Jeffery Hicks has a great article about creating advanced PowerShell terminal tools using the PwshSpectreConsole module to enhance data visualization. The post provides functional script examples for monitoring top processes and displaying system health data in dynamic, colorized tree and panel formats.

https://buttondown.com/behind-the-powershell-pipeline/archive/even-more-pwshspectreconsole-tools/

Upcoming Events

PowerShell + DevOps Global Summit 2026 April 13-17, 2026 in Bellevue, WA - The premier PowerShell community event returns this spring!

https://www.powershellsummit.org/

PSConfEU 2026 June 1-4, 2026 in Wiesbaden, Germany - Call for speakers is now closed.

https://psconf.eu/

Andrew Taylor, author of the Intune Newsletter, has a great new book about mastering cloud-connected endpoint management across multiple platforms including Windows, macOS, and Android. This second edition provides practical, recipe-based workflows for automating administration with PowerShell and leveraging AI-powered insights through Security Copilot. If you are an IT administrator looking to modernize your device management and security posture with proven, hands-on techniques, I highly recommend picking up a copy of this comprehensive guide.

I have actually read the chapter on PowerShell and it is awesome.

https://www.amazon.com/Microsoft-Intune-Cookbook-configuring-automating-ebook/dp/B0GPQFTZST/

https://andrewstaylor.com/category/newsletter/

Using Strict Mode in PowerShell

Harm Veenstra has an interesting new article about how using Set-StrictMode can help you write better code by catching common scripting mistakes like uninitialized variables or invalid array indexes. This post provides practical examples of how enabling strict mode transforms silent failures into helpful, terminating errors that make troubleshooting significantly easier.

If you want to dive deeper into mastering cloud-connected endpoint management and automation, I highly recommend buying his book, the Microsoft Intune Cookbook.

https://powershellisfun.com/2026/02/20/using-strict-mode-in-powershell/

Escaping Tutorial Hell with Pablo Correchel. The PowerShell Podcast E215

Pablo Correchel has an interesting video about how early-career IT professionals can accelerate their learning by moving away from passive tutorials and embracing public documentation of their progress. The episode emphasizes the power of consistent practice, the value of asking beginner questions, and how sharing your journey on platforms like LinkedIn can lead to unexpected career opportunities and community support.

How to Use Scoped Graph Permissions with SharePoint Lists

Tony Redmond has an interesting article about how to implement granular access control for SharePoint lists and items using scoped Microsoft Graph permissions. This approach allows administrators to restrict application access to specific data points rather than granting broad, site-wide permissions.

https://office365itpros.com/2026/02/25/scoped-graph-permission-lists/

Resolving The Registry Challenge

Jeffery Hicks has a good article on how to solve a PowerShell scripting challenge focused on querying the Windows registry for auto-run applications. The post demonstrates how to use registry PSDrives to extract application names and command lines from both machine and user-specific hives, while also showing how to create custom objects and formatted output for the results.

https://buttondown.com/behind-the-powershell-pipeline/archive/resolving-the-registry-challenge/

Why You Need to Learn PowerShell

Adeel Automates has a great video about why mastering PowerShell is essential for any IT professional serious about moving from support roles into high-level engineering. The video explains that while manual clicking through portals doesn’t scale, PowerShell allows for the control of massive environments at machine speed, turning repetitive tasks into automated processes that run without fatigue or error.

PowerShell, OpenSSH, and DSC team investments for 2026

Steve Lee has a great article about the upcoming development roadmap for PowerShell 7.7, including significant changes to user content paths and the introduction of AI-assisted scripting tools. The post also details major security enhancements and the transition to the Microsoft Artifact Registry for more reliable module management. Note that this was covered last week from the transcript, but this is straight from Microsoft.

https://devblogs.microsoft.com/powershell/powershell-openssh-and-dsc-team-investments-for-2026/

Upcoming Events

Zero Trust World 2026 - March 4th-6th Rosen Shingle Creek, Orlando, Florida. Zero Trust conference by ThreatLocker.

https://ztw.com/

PowerShell + DevOps Global Summit 2026 April 13-17, 2026 in Bellevue, WA - The premier PowerShell community event returns this spring!

https://www.powershellsummit.org/

PSConfEU 2026 June 1-4, 2026 in Wiesbaden, Germany - Call for speakers is now closed.

https://psconf.eu/