/changelogs/microsoft-graph/msonline-azuread-to-microsoft-graph
MSOnline and AzureAD PowerShell retired: move to Microsoft Graph PowerShell (cmdlet map)
- tool
- Microsoft Graph PowerShell
- versions
- MSOnline / AzureAD PowerShell → Microsoft Graph PowerShell SDK 2.x
The MSOnline and AzureAD PowerShell modules are deprecated. Microsoft's Azure AD PowerShell overview states that they were deprecated as of March 30, 2024, with support limited to migration assistance and security fixes, and that they would continue to function through March 30, 2025 (MSOnline 1.0.x could be disrupted after June 30, 2024). Scripts that still call Connect-MsolService or Connect-AzureAD must move to Microsoft Graph PowerShell (or the Microsoft Entra PowerShell module, which is built on it).
Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "User.ReadWrite.All", "Organization.Read.All"Cmdlet map
From Microsoft's "Find Azure AD and MSOnline cmdlets in Microsoft Graph PowerShell":
| MSOnline / AzureAD | Microsoft Graph PowerShell |
|---|---|
| Connect-MsolService, Connect-AzureAD | Connect-MgGraph |
| Get-MsolUser, Get-AzureADUser | Get-MgUser |
| New-MsolUser, New-AzureADUser | New-MgUser |
| Set-MsolUser | Update-MgUser |
| Remove-MsolUser | Remove-MgUser |
| Set-MsolUserLicense, Set-AzureADUserLicense | Set-MgUserLicense |
| Get-MsolAccountSku, Get-AzureADSubscribedSku | Get-MgSubscribedSku |
| Set-MsolUserPassword | Reset-MgUserAuthenticationMethodPassword |
| Get-MsolGroup | Get-MgGroup |
| Get-AzureADGroupMember | Get-MgGroupMember |
| Add-AzureADGroupMember | New-MgGroupMemberByRef |
| Get-MsolCompanyInformation | Get-MgOrganization |
| Get-AzureADDirectoryRole | Get-MgDirectoryRole |
| Get-MsolRoleMember | Get-MgDirectoryRoleMember |
Typical rewrites
# Before (MSOnline)
Get-MsolUser -All | Where-Object { $_.IsLicensed }
Set-MsolUserLicense -UserPrincipalName anna@contoso.com -AddLicenses "contoso:ENTERPRISEPACK"
# After (Microsoft Graph PowerShell)
Get-MgUser -All -Property DisplayName,UserPrincipalName,AssignedLicenses |
Where-Object { $_.AssignedLicenses.Count -gt 0 }
$sku = Get-MgSubscribedSku -All | Where-Object SkuPartNumber -eq 'ENTERPRISEPACK'
Set-MgUserLicense -UserId anna@contoso.com -AddLicenses @{SkuId = $sku.SkuId} -RemoveLicenses @()Differences to expect:
- Permissions are explicit. MSOnline acted with all the rights of the signed-in admin; Graph cmdlets act only within the scopes you request, so a missing scope shows up as Insufficient privileges.
- Properties must be selected.
Get-MgUserreturns a small default set; ask for others with-Property. - Licenses use GUIDs. MSOnline's
tenant:SKUPARTNUMBERstrings becomeSkuIdGUIDs fromGet-MgSubscribedSku. - Find the replacement of any cmdlet with
Find-MgGraphCommand, and the permission it needs from itsPermissionsproperty.
Migration steps
Microsoft's suggested process: inventory the scripts (purpose, where they run, how often, which cmdlets), prioritize them, then rewrite and test each with the least privileged scopes. Microsoft Graph PowerShell runs in Windows PowerShell 5.1 and PowerShell 7 on Windows, macOS and Linux, which MSOnline never did.