In this guide, I will show you how to install Microsoft Graph PowerShell Module. It is the recommended and supported way to connect with Microsoft 365 and Entra ID. It provides you with a set of cmdlets to manage users, devices, licenses, security, Intune, Teams, SharePoint, Exchange, and more.
Microsoft Graph PowerShell SDK comes in two modules, Microsoft.Graph and Microsoft.Graph.Beta that calls Microsoft Graph REST v1.0 and Microsoft Graph REST API beta endpoints. Graph v1.0 is stable production ready API and beta exposes API which are in preview and are not generally available. Microsoft recommended using v1.0 endpoint wherever possible, as beta endpoints may change and could impact your production code.
You can install both Microsoft.Graph (v1.0) and Microsoft.Graph.Beta side by side on the same machine, but avoid loading both in the same PowerShell session. Use v1.0 for production code and switch to beta only when a preview feature is required. You do not need to install both modules to use Graph. Installing both simply increases download and update overhead, and importing both in one session can cause ambiguity or conflicts, so keep sessions separate for reliability.
If your scripts currently use Azure AD PowerShell or MSOnline cmdlets, you can update them to use Microsoft Graph PowerShell instead. Microsoft provides a reference page that maps the old Azure AD and MSOnline cmdlets to their Graph equivalents, making it easier to update your scripts. Refer to the link: Find Azure AD and MSOnline cmdlets in Microsoft Graph PowerShell | Microsoft Learn
Detect and Remove Deprecated Modules
Get-InstalledModule AzureAD, MSOnline -ErrorAction SilentlyContinue |
ForEach-Object { Uninstall-Module $_.Name -AllVersions -Force }I’ll start by highlighting some key features of Graph PowerShell, along with its prerequisites and installation steps. Then I’ll walk you through how to connect using different scopes, and finally, I’ll share the steps to update and uninstall graph modules.
Contents
Microsoft Graph PowerShell SDK
Below are some key features of Microsoft Graph PowerShell SDK. For more Information, refer to the link: Install the Microsoft Graph PowerShell SDK | Microsoft Learn.
- Unified automation across Microsoft 365 and Entra ID using the Microsoft Graph API
- Granular permissions via OAuth scopes for least-privilege access.
- Cross-platform support on Windows, macOS, and Linux with PowerShell 7+. It also supports PowerShell 5.1 on Windows.
- Modular design so you can install only what you require, or the full bundle.
- Profiles to switch between v1.0 and beta endpoints when you want to use preview features.
- App-only and delegated authentication options.
- Throttling and retry behavior built in by the SDK.
Prerequisites
The following list shows the requirements for installing Microsoft Graph PowerShell SDK.
- PowerShell 5.1 or later (recommended PowerShell 7+).
- Install .NET Framework 4.7.2 or later.
- Install/Update PowerShellGet to latest version, use below command:
Install-Module PowerShellGet -Force- PowerShell script execution policy must be set to remote signed (recommended) or Unrestricted.
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser -ForceSteps to Install Microsoft Graph PowerShell Module
Follow the steps below to install the Microsoft Graph PowerShell module on your device. You can use Windows, macOS, or Linux as long as you’re running PowerShell 7 or later. If you are on Windows, you can use PowerShell 5.1 or 7+ version. I’ll be showing the steps from a Windows device running PowerShell 5.1 (Check PowerShell version using this command: $PSVersionTable.PSVersion).
Open a PowerShell console and first execute the commands listed in the prerequisites section, then continue with the commands below to install the Graph module. Run all installation commands in an elevated PowerShell session (Run as Administrator) on Windows. On macOS/Linux, run with sufficient privileges or use -Scope CurrentUser.
1. Install Microsoft Graph PowerShell module
Open the PowerShell console on your computer. You can run it either as an administrator or as a standard user. If you choose to run it as a standard user, you’ll need to add -Scope CurrentUser to the command; otherwise, it will fail.
Trust PSGallery
Set-PSRepository -Name 'PSGallery' -InstallationPolicy TrustedInstall Microsoft Graph PowerShell v1.0 module (doesn’t require running PowerShell as an administrator)
Install-Module Microsoft.Graph -Scope CurrentUser -Repository PSGallery -ForceAfter running install-module cmdlet, if you get the error, NuGet provider is required to continue. Run below commands first:
1. Get-PackageProvider -Name NuGet -ListAvailable
2. Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
Alternatively, you can use this all-in-one code snippet. It checks if NuGet is installed and meets the version requirements, and if not, installs it automatically:
$nu = Get-PackageProvider -Name NuGet -ListAvailable -ErrorAction SilentlyContinue
if (-not $nu -or [version]$nu.Version -lt [version]”2.8.5.201″) {
Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
}
Install Microsoft Graph PowerShell v1.0 module (requires running PowerShell as an administrator)
Install-Module Microsoft.Graph -Scope AllUsers -AllowClobber -ForceInstall Microsoft Graph beta module (doesn’t require running PowerShell as an administrator)
Install-Module Microsoft.Graph.Beta -Scope CurrentUser -ForceInstall Microsoft Graph beta module (requires running PowerShell as an administrator)
Install-Module Microsoft.Graph.Beta -Repository PSGallery -ForceMicrosoft Graph PowerShell SDK includes about 47 submodules, downloading and installing all the modules using Microsoft.Graph can take some time, install only the modules you want to work with. To find the list of Graph modules, run Find-Module Microsoft.Graph* command.
Installing specific Graph PowerShell modules (examples)
Install-Module Microsoft.Graph.Users
Install-Module Microsoft.Graph.Authentication
Install-Module Microsoft.Graph.Groups
Install-Module Microsoft.Graph.DeviceManagement # Intune
Install-Module Microsoft.Graph.Identity.DirectoryManagement2. Verify Graph PowerShell Module Installation
Run below commands to check and confirm if the graph modules are installed on your system.
Verify Graph PowerShell Installation
Get-InstalledModule Microsoft.Graph
or
Get-InstalledModule3. Connect using Microsoft Graph PowerShell
The simplest and most common way to connect to Microsoft Graph PowerShell is by using interactive delegated authentication with least-privilege scopes. Scopes determine the level of access you get to perform a specific task via Graph.
It’s a good practice to start with read-only permissions and expand to higher permissions only if needed. For example, running the command with the scopes User.Read.All and Group.Read.All gives you read-only access to users and groups in Entra ID.
If you’re not sure which scopes to use, refer to my other post, where I cover several ways to identify the right level of scope for connecting to Graph: 6 Ways to Find Microsoft Graph PowerShell Scopes.
Connect to Graph with User and Group RO permissions
Connect-MgGraph -Scopes "User.Read.All","Group.Read.All" -NoWelcomeConnect to Graph using Group R/W and Directory R/W permission
Connect-MgGraph -Scopes "Group.ReadWrite.All","Directory.ReadWrite.All" -NoWelcome
Connect to Graph using Device code
Connect-MgGraph -Scopes "User.Read.All" -UseDeviceCode
Target a tenant explicitly
Connect-MgGraph -TenantId "<tenant-guid>" -Scopes "User.Read.All"Run a test command to check and confirm you are connected (example)
Get-MgUser -UserId "[email protected]" -Property id,displayName,mail | Select-Object id,displayName,mail
Connect with app-only (certificate or secret)
For automation jobs with no user interaction, use app-only auth or Certificate based authentication. Your app must be granted Graph application permissions in Entra ID, and those permissions must be admin-consented. Refer to this article for more information: Create Microsoft 365 Groups Using PowerShell
# Certificate-based app-only
Connect-MgGraph -ClientId "<app-id>" -TenantId "<tenant-id>" -CertificateThumbprint "<thumbprint>" -NoWelcome
# Secret-based app-only (less secure; use Key Vault + managed identity when possible)
Connect-MgGraph -ClientId "<app-id>" -TenantId "<tenant-id>" -ClientSecret (Read-Host -AsSecureString "Client secret") -NoWelcomeSwitch to Beta Version
When you want to switch to graph beta, you will have to install the Graph PowerShell beta module as shown above. Keep in mind that beta version has commands with beta word in it. For reference, see the page: Microsoft.Graph.Beta.Users Module | Microsoft Learn
Graph Modules for Microsoft 365 admins
You can install complete bundle of Microsoft Graph which would install all modules on your system. As a Microsoft 365 admin, you probably won’t require all the module, you can run below code snippet to install the relevant ones.
Graph Modules for M365 admins
$mods = @(
"Microsoft.Graph.Users",
"Microsoft.Graph.Groups",
"Microsoft.Graph.Identity.DirectoryManagement",
"Microsoft.Graph.DeviceManagement",
"Microsoft.Graph.Reports"
)
$mods | ForEach-Object { Install-Module $_ -Scope CurrentUser -Force }Update Microsoft Graph PowerShell Modules
It’s recommended to update Graph PowerShell modules regularly. For updating the modules, use below commands:
Run on the PowerShell console opened as administrator
Update-Module Microsoft.Graph -ForceUpdate only selected modules
Update-Module Microsoft.Graph.Users, Microsoft.Graph.Groups -ForceUpdate everything you have from Microsoft.Graph
Get-InstalledModule Microsoft.Graph* | Update-Module -Force
Uninstall All Microsoft Graph PowerShell Modules
Run the below code snippet on your elevated PowerShell console to first disconnect from graph, then uninstall all versions of Microsoft Graph.
If you installed in both user and all-users scopes, repeat in an elevated session and in a normal session with -Scope CurrentUser.
Uninstall all graph modules
# Close all sessions using the module
Disconnect-MgGraph 2>$null
# Remove every installed Microsoft.Graph* module, all versions
Get-InstalledModule Microsoft.Graph* -AllVersions |
Sort-Object Name -Descending |
ForEach-Object {
try { Uninstall-Module $_.Name -AllVersions -Force -ErrorAction Stop }
catch { Write-Host "Failed to remove $($_.Name): $($_.Exception.Message)" }
}