GraphKit

0.3.0

App-only, multi-tenant Microsoft Graph execution and analysis layer with explicit Intune and Entra operation semantics.

Minimum PowerShell version

7.4

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name GraphKit

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name GraphKit

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

adamgell

Copyright

Package Details

Author(s)

Adam Gell

Functions

Compare-GraphPermission Export-GraphResult Get-GraphAppRegistrationPermission Get-GraphContext Get-GraphObject Get-GraphOperation Get-GraphTenant Grant-GraphAppPermission Import-GraphLegacyProfile Invoke-GraphBatch Invoke-GraphOperation Register-GraphTenant Remove-GraphTenant Test-GraphPermission Test-GraphTenant Use-GraphTenant

Dependencies

- Microsoft.Graph.Authentication (>= 2.38.1)

Release Notes

0.3.0

Integrated next package. The published PSGallery 0.2.2 artifact remains immutable.

CHANGED
- Microsoft.PowerShell.SecretManagement 1.1.2+ is resolved only at first vault use.
Non-vault import, managed identity, help, and catalog inspection no longer require it.
- Vault commands are module-qualified and the boundary rejects an unavailable or too-old
SecretManagement module instead of accepting unrelated same-named functions.
- Install-GraphKitPinned installs only hard Microsoft.Graph.Authentication by default for
0.3.0, offers -InstallSecretManagement for vault hosts, and preserves automatic
SecretManagement installation for immutable 0.2.2 pins.

ADDED AND LIVE-VERIFIED 2026-08-29
- DeviceManagementUnifiedRoleAssignment.ListBeta with required roleDefinition/principals
expansion and DeviceManagementRBAC.Read.All.
- DeviceManagementTemplate.ListBeta, DeviceManagementConfigurationPolicyTemplate.ListBeta,
and DeviceManagementIntent.ListBeta for legacy baseline and current Settings Catalog
template/version, assignment, lifecycle, and deprecation interpretation.
- ManagedDeviceCleanupRule.ListBeta, the documented per-platform collection, replacing the
obsolete undocumented managedDeviceCleanupSettings singleton.

VERIFICATION CORRECTION
- NamedLocation.List is positively proven app-only with Policy.Read.All. The narrower
Policy.Read.ConditionalAccess scope remains insufficient.
- DeviceManagementScript.List remains scope-gated: the service named
DeviceManagementScripts.Read.All in its 403, but no successful live response is claimed.

Requires PowerShell 7.4+.

FileList

Version History

Version	Downloads	Last updated
0.3.0 (current version)	59	8/30/2026
0.2.2	87	8/19/2026
0.2.0	7	8/17/2026
0.1.1	91	8/16/2026
0.1.0	15	8/16/2026