GraphKit
0.2.0
App-only, multi-tenant Microsoft Graph execution and analysis layer with explicit Intune and Entra operation semantics.
Minimum PowerShell version
7.4
Installation Options
Owners
Copyright
(c) Adam Gell. All rights reserved.
Package Details
Author(s)
- Adam Gell
Tags
Microsoft365 MicrosoftGraph Graph Intune Entra EntraID MDM DeviceManagement MultiTenant AppOnly Automation Windows Linux MacOS
Functions
Compare-GraphPermission Export-GraphResult Get-GraphAppRegistrationPermission Get-GraphContext Get-GraphObject Get-GraphOperation Get-GraphTenant Grant-GraphAppPermission Import-GraphLegacyProfile Invoke-GraphBatch Invoke-GraphOperation Register-GraphTenant Remove-GraphTenant Test-GraphPermission Test-GraphTenant Use-GraphTenant
Dependencies
This module has no dependencies.
Release Notes
0.2.0
A minor bump rather than a patch: three changes alter the output or the calling contract of
commands that shipped in 0.1.1, and the catalog grew from 55 operations to 69.
BREAKING-ISH - existing callers should read these three:
- Every export format now redacts declared secret-bearing properties. Previously only -As Json
redacted, while -As Csv, -As Markdown and the VaultEvidence rows.json wrote rows raw. Use
-NoRedact for the previous behaviour.
- CSV cells beginning = + - @ are prefixed with an apostrophe so a spreadsheet does not execute
them as formulas. Strings only; negative numbers are untouched.
- Invoke-GraphOperation now supports -WhatIf, and operations declared High impact require -Force.
Nothing prompts by default, so unattended writes still run - but a High-impact call without
-Force now fails instead of executing.
WRITE OPERATIONS - the catalog is no longer read-only.
Eight writes ship, each declaring an Impact (Low/Medium/High) that governs how hard it is to run
by accident. What counts as mutating is declared by the descriptor's ReplayPolicy, never inferred
from the HTTP verb, because two descriptors are POSTs that change nothing. ManagedDevice.Wipe is
the only High-impact operation and requires -Force; -Force bypasses that confirmation and nothing
else. Every assignment write ships with the read that makes it usable, because Graph's /assign is
a REPLACE and omitted assignments are removed.
Added: ManagedDevice.SyncDevice / Retire / Delete / Wipe, DeviceCompliancePolicy.Assign,
DeviceConfiguration.Assign, ConfigurationPolicy.AssignBeta.
FIXED - a wrong answer that looked like a right one:
- A PathTemplate that fixes a query option now extends it with '&' instead of a second '?'.
Resolve-GraphUri always joined with '?', so a fixed option plus a caller-supplied one produced
'?$expand=a?$filter=b' - not two options, since the second '?' becomes part of the first
option's value. Graph answered 200 and IGNORED the filter, returning a complete collection that
read as a filtered one.
- Get-GraphOperation returns a deep copy. It previously handed out cached catalog objects, so a
caller mutating one changed the descriptor every later operation used, CredentialPolicy
included.
- Actions may declare no request body. The action strategy demanded one from every action, which
excluded most of the write surface: Intune device actions are bodyless POSTs and deletes carry
no body at all.
ADDED - descriptors, 55 -> 69:
- The Administrative Template walk: GroupPolicyConfiguration / GroupPolicyDefinitionValue /
GroupPolicyPresentationValue (ListBeta). The two child operations fix a load-bearing $expand in
their path; without it the rows come back 200 with no indication of which setting they
configure.
- ConfigurationPolicyAssignment.ListBeta, closing a silent gap - assignment reads existed for
compliance, device configuration and mobile apps, so a reconciliation across policy types
contributed nothing for Settings Catalog and still reported success.
- AuthorizationPolicy.Get, DirectorySetting.List and DirectorySettingTemplate.List. The templates
are not optional: /settings returns only INSTANTIATED settings, so an absent row means the
template default applies - not that the tenant is unconfigured.
- Descriptors may declare SensitiveProperties and Impact, both validated at load.
Requires PowerShell 7.4+. 721 tests, 0 skipped, green on Windows, Linux and macOS across
PowerShell 7.4 and 7.6.
FileList
- GraphKit.nuspec
- Data\Operations\AndroidEnrollmentProfile.List.psd1
- Data\Operations\AppConfigurationPolicy.List.psd1
- Data\Operations\AppInstallSummaryReport.Get.psd1
- Data\Operations\AppProtectionPolicy.List.psd1
- Data\Operations\AppleEnrollmentProgramToken.List.psd1
- Data\Operations\AppleVppToken.List.psd1
- Data\Operations\AuthenticationMethodsPolicy.Get.psd1
- Data\Operations\AuthorizationPolicy.Get.psd1
- Data\Operations\AutopilotDevice.List.psd1
- Data\Operations\CertificateConnector.List.psd1
- Data\Operations\ConditionalAccessPolicy.List.psd1
- Data\Operations\ConfigurationConflict.List.psd1
- Data\Operations\ConfigurationPolicy.AssignBeta.psd1
- Data\Operations\ConfigurationPolicy.ListBeta.psd1
- Data\Operations\ConfigurationPolicyAssignment.ListBeta.psd1
- Data\Operations\ConfigurationPolicySetting.ListBeta.psd1
- Data\Operations\ConfigurationSettingDefinition.ListBeta.psd1
- Data\Operations\DeviceCategory.List.psd1
- Data\Operations\DeviceCategory.ListBeta.psd1
- Data\Operations\DeviceCleanupRule.Get.psd1
- Data\Operations\DeviceCompliancePolicy.Assign.psd1
- Data\Operations\DeviceCompliancePolicy.List.psd1
- Data\Operations\DeviceCompliancePolicy.ListBeta.psd1
- Data\Operations\DeviceCompliancePolicyAssignment.List.psd1
- Data\Operations\DeviceConfiguration.Assign.psd1
- Data\Operations\DeviceConfiguration.List.psd1
- Data\Operations\DeviceConfiguration.ListBeta.psd1
- Data\Operations\DeviceConfigurationAssignment.List.psd1
- Data\Operations\DeviceEnrollmentConfiguration.List.psd1
- Data\Operations\DeviceEnrollmentConfiguration.ListBeta.psd1
- Data\Operations\DeviceManagementScript.List.psd1
- Data\Operations\DeviceReport.Export.psd1
- Data\Operations\DirectoryRoleAssignment.List.psd1
- Data\Operations\DirectoryRoleDefinition.List.psd1
- Data\Operations\DirectoryRoleDefinition.ListBeta.psd1
- Data\Operations\DirectorySetting.List.psd1
- Data\Operations\DirectorySettingTemplate.List.psd1
- Data\Operations\Domain.List.psd1
- Data\Operations\DomainConnector.List.psd1
- Data\Operations\EntraDevice.List.psd1
- Data\Operations\EntraDevice.ListBeta.psd1
- Data\Operations\Group.List.psd1
- Data\Operations\Group.ListBeta.psd1
- Data\Operations\GroupMember.List.psd1
- Data\Operations\GroupPolicyConfiguration.ListBeta.psd1
- Data\Operations\GroupPolicyDefinitionValue.ListBeta.psd1
- Data\Operations\GroupPolicyPresentationValue.ListBeta.psd1
- Data\Operations\ManagedDevice.Delete.psd1
- Data\Operations\ManagedDevice.Get.psd1
- Data\Operations\ManagedDevice.List.psd1
- Data\Operations\ManagedDevice.ListBeta.psd1
- Data\Operations\ManagedDevice.Retire.psd1
- Data\Operations\ManagedDevice.SyncDevice.psd1
- Data\Operations\ManagedDevice.Wipe.psd1
- Data\Operations\ManagedDeviceSetting.Get.psd1
- Data\Operations\MobileApp.Assign.psd1
- Data\Operations\MobileApp.List.psd1
- Data\Operations\MobileApp.ListBeta.psd1
- Data\Operations\MobileAppAssignment.List.psd1
- Data\Operations\MobileAppCategory.List.psd1
- Data\Operations\NamedLocation.List.psd1
- Data\Operations\Organization.GetMdmAuthority.psd1
- Data\Operations\Organization.List.psd1
- Data\Operations\Organization.ListBeta.psd1
- Data\Operations\SecurityDefaultsPolicy.Get.psd1
- Data\Operations\ServicePrincipal.List.psd1
- Data\Operations\SubscribedSku.List.psd1
- Data\Operations\User.List.psd1
- Data\Operations\WindowsUpdateCatalogItem.List.psd1
- Formats\GraphKit.Format.ps1xml
- GraphKit.psd1
- GraphKit.psm1
- en-US\about_GraphKit.help.txt
Version History
| Version | Downloads | Last updated |
|---|---|---|
| 0.2.0 (current version) | 5 | 8/17/2026 |
| 0.1.1 | 88 | 8/16/2026 |
| 0.1.0 | 15 | 8/16/2026 |