GraphKit

0.2.0

App-only, multi-tenant Microsoft Graph execution and analysis layer with explicit Intune and Entra operation semantics.

Minimum PowerShell version

7.4

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name GraphKit

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name GraphKit

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

(c) Adam Gell. All rights reserved.

Package Details

Author(s)

  • Adam Gell

Tags

Microsoft365 MicrosoftGraph Graph Intune Entra EntraID MDM DeviceManagement MultiTenant AppOnly Automation Windows Linux MacOS

Functions

Compare-GraphPermission Export-GraphResult Get-GraphAppRegistrationPermission Get-GraphContext Get-GraphObject Get-GraphOperation Get-GraphTenant Grant-GraphAppPermission Import-GraphLegacyProfile Invoke-GraphBatch Invoke-GraphOperation Register-GraphTenant Remove-GraphTenant Test-GraphPermission Test-GraphTenant Use-GraphTenant

Dependencies

This module has no dependencies.

Release Notes

0.2.0

A minor bump rather than a patch: three changes alter the output or the calling contract of
commands that shipped in 0.1.1, and the catalog grew from 55 operations to 69.

BREAKING-ISH - existing callers should read these three:
- Every export format now redacts declared secret-bearing properties. Previously only -As Json
 redacted, while -As Csv, -As Markdown and the VaultEvidence rows.json wrote rows raw. Use
 -NoRedact for the previous behaviour.
- CSV cells beginning = + - @ are prefixed with an apostrophe so a spreadsheet does not execute
 them as formulas. Strings only; negative numbers are untouched.
- Invoke-GraphOperation now supports -WhatIf, and operations declared High impact require -Force.
 Nothing prompts by default, so unattended writes still run - but a High-impact call without
 -Force now fails instead of executing.

WRITE OPERATIONS - the catalog is no longer read-only.
Eight writes ship, each declaring an Impact (Low/Medium/High) that governs how hard it is to run
by accident. What counts as mutating is declared by the descriptor's ReplayPolicy, never inferred
from the HTTP verb, because two descriptors are POSTs that change nothing. ManagedDevice.Wipe is
the only High-impact operation and requires -Force; -Force bypasses that confirmation and nothing
else. Every assignment write ships with the read that makes it usable, because Graph's /assign is
a REPLACE and omitted assignments are removed.

Added: ManagedDevice.SyncDevice / Retire / Delete / Wipe, DeviceCompliancePolicy.Assign,
DeviceConfiguration.Assign, ConfigurationPolicy.AssignBeta.

FIXED - a wrong answer that looked like a right one:
- A PathTemplate that fixes a query option now extends it with '&' instead of a second '?'.
 Resolve-GraphUri always joined with '?', so a fixed option plus a caller-supplied one produced
 '?$expand=a?$filter=b' - not two options, since the second '?' becomes part of the first
 option's value. Graph answered 200 and IGNORED the filter, returning a complete collection that
 read as a filtered one.
- Get-GraphOperation returns a deep copy. It previously handed out cached catalog objects, so a
 caller mutating one changed the descriptor every later operation used, CredentialPolicy
 included.
- Actions may declare no request body. The action strategy demanded one from every action, which
 excluded most of the write surface: Intune device actions are bodyless POSTs and deletes carry
 no body at all.

ADDED - descriptors, 55 -> 69:
- The Administrative Template walk: GroupPolicyConfiguration / GroupPolicyDefinitionValue /
 GroupPolicyPresentationValue (ListBeta). The two child operations fix a load-bearing $expand in
 their path; without it the rows come back 200 with no indication of which setting they
 configure.
- ConfigurationPolicyAssignment.ListBeta, closing a silent gap - assignment reads existed for
 compliance, device configuration and mobile apps, so a reconciliation across policy types
 contributed nothing for Settings Catalog and still reported success.
- AuthorizationPolicy.Get, DirectorySetting.List and DirectorySettingTemplate.List. The templates
 are not optional: /settings returns only INSTANTIATED settings, so an absent row means the
 template default applies - not that the tenant is unconfigured.
- Descriptors may declare SensitiveProperties and Impact, both validated at load.

Requires PowerShell 7.4+. 721 tests, 0 skipped, green on Windows, Linux and macOS across
PowerShell 7.4 and 7.6.

FileList

Version History

Version Downloads Last updated
0.2.0 (current version) 5 8/17/2026
0.1.1 88 8/16/2026
0.1.0 15 8/16/2026