Intro to Graph for Azure Admins

Part 2: Using Graph

So, how to send a graph request?

You can interact with Microsoft Graph API through several methods.

As an Azure administrator, You'll mostly access it through the Graph PowerShell module, Graph Explorer or by directly invoking an HTTP call to the API.

Microsoft Graph PowerShell SDK

The Microsoft Graph PowerShell module acts as a wrapper around the Microsoft Graph REST API, translating PowerShell cmdlets into corresponding HTTP requests.


It is designed for administrators, with simpler syntax compared to raw API calls and is ideal for scripting and automating administrative tasks.

Connection, Commands, and Permissions

To work with Graph in PowerShell, you'll need to:


  1. Install the Microsoft Graph PowerShell SDK:

install-module Microsoft.Graph -Scope CurrentUser

  1. Start a session by authenticating using:

connect-mggraph -scope 'directory.read.all'

When connecting to Microsoft Graph via the PowerShell module, you must specify the permissions required for your session with the -scope flag.

Unlike the previous modules, where each module (such as AzureAD or MSOnline) had its own set of permissions, the Graph PowerShell SDK uses a unified set of permissions under the Microsoft Graph API, registered as an enterprise application in Entra ID.

The Microsoft Graph API comes in two versions: v1.0 and beta. The v1.0 version is the stable and recommended version for production use. The beta version, on the other hand, includes new features and updates that are still in development.

1. GET (HTTP) -> Get- (PowerShell)

  • Purpose: Retrieve information.

  • Example:

Get-MgUser

  • Usage:

Get-MgUser -UserId {id}
# Fetch details of a specific user

2. POST (HTTP) -> New- (PowerShell)

  • Purpose: Create a new resource.

  • Example:

New-MgGroup

  • Usage:

New-MgGroup -DisplayName "Project Team" -MailEnabled $true -SecurityEnabled $false -MailNickname "projectteam"
# Create a new Microsoft 365 group

3. PUT (HTTP) -> Set- (PowerShell)

  • Purpose: Update or create a resource.

  • Example:

Set-MgEvent

  • Usage:

Set-MgEvent -EventId {id} -Subject "Updated Meeting"
# Update the details of an existing calendar event.

4. PATCH (HTTP) -> Update- (PowerShell)

  • Purpose: Apply partial updates.

  • Example:

Update-MgApplication

  • Usage:

Update-MgApplication -ApplicationId {id} -DisplayName "Updated App Name"
# Modify specific properties of an application.

5. DELETE (HTTP) -> Remove- (PowerShell)

  • Purpose: Delete a resource.

  • Example:

Remove-MgDevice

  • Usage:

Remove-MgDevice -DeviceId {id}
# Delete a device from the directory.

Finding commands

The find-mggraph cmdlet will help you find the graph command you need, plus information on that command like the required permissions your session needs to run it.

To find details about a specific command (such as get-mguser):

Find-MgGraphCommand -Command "Get-MgUser"

You can search for all cmdlets that include the word "User" in their names, but these kinds of searches provide very large outputs:

Find-MgGraphCommand -Command "*User*"

Alternatively, searching for commands by URI offers the flexibility of identifying the general area of the operation without needing the exact command name, often resulting in more focused outputs:

Find-MgGraphCommand -Uri "/users/"

Narrow down the search to cmdlets available in Graph v1.0:

Find-MgGraphCommand -Command "*User*" -ApiVersion "v1.0"

Uses a regular expression to find cmdlets related to updating user information:

Find-MgGraphCommand -Command ".*Update.*User.*"

Scopes

Next, determine the required permissions for the command. We can do this by expanding the permissions column from the previous terminal output: 

Find-MgGraphCommand -Command "*User*" | Select-Object -ExpandProperty Permissions

The idea is that any single permission listed in the command output should allow you to perform the desired action, depending on whether you need read or write access.

Additionally, let's compare another version of the command that uses a different syntax. Here’s how the commands differ:

(find-mggraphcommand -command "get-mguser").permissions
Find-MgGraphCommand -command Get-MgUser | Select -First 1 -ExpandProperty Permissions

The primary difference is in the way the permissions are accessed and displayed.

Graph Explorer

Graph Explorer is a web-based tool provided by Microsoft that allows you to interact with the Microsoft Graph API without writing any code. It is an excellent resource for testing and learning how the API works.

It is also easy to use. Graph Explorer is a graphical interface that helps you construct Graph requests straight from your browser and includes sample queries to help you get started quickly. You can see the JSON requests and responses, as well as further debugging info. On top of that, you can use your work or even personal account to connect and start testing.

Issuing a REST API call from PowerShell

We can also issue an HTTP call directly to the Graph REST API from PowerShell, using the Invoke-MgGraphRequest cmdlet.

This way, where sometimes a PowerShell command for a Graph operation may not exist, we can send the Graph REST API an HTTP call it will directly understand.


Let's say you want to know the Entra ID roles that have been assigned to a particular user. The Graph API is capable of finding this information and providing it to you, but there isn't yet a simple PowerShell command to accomplish this.


In a situation like this, we can issue HTTP call through the Graph PowerShell module by using Invoke-MgGraphRequest.

Here we can issue a REST API call that is completely customized to our needs directly to the relevant API endpoint... and send any relevant headers or parameters from PowerShell. 

$response = $null
$uri = "https://graph.microsoft.com/beta/roleManagement/directory/transitiveRoleAssignments?`$count=true&`$filter=principalId eq 'aaaaaaaa-bbbb-cccc-1111-222222222222'"
$method = 'GET'
$headers = @{'ConsistencyLevel' = 'eventual'}

$response = (Invoke-MgGraphRequest -Uri $uri -Headers $headers -Method $method -Body $null).value

Build Cloud Skills

Contact us

Events

Address: Twelve Quays House, Egerton Wharf CH41 1LD