Software and access requirements.
- PowerShell 7.2 or later
- Microsoft.Graph.Authentication
- Optional ExchangeOnlineManagement and MicrosoftTeams
- Admin consent for required read permissions
- Appropriate Microsoft licences for selected data sources
Extract the package and open PowerShell 7 in the product folder.
Set-ExecutionPolicy -Scope Process Bypass
./distribution/Install-GraphSecDependencies.ps1Edit config/graphsec.config.json.
Set customer name, thresholds, enabled modules and authentication mode. Optional organisational evidence can be added to config/manual-evidence.csv.
Choose interactive, device-code, certificate or managed-identity operation.
Interactive
Manual execution by an administrator.
"Mode": "Interactive"Device code
Alternative for sessions without a browser; Security Defaults or access policies may block token issuance.
"UseDeviceCode": trueCertificate
Preferred repeatable customer mode: app-only with tenant ID, client ID and certificate files or a Windows certificate thumbprint.
"Mode": "Certificate"Managed identity
For supported Azure environments.
"Mode": "ManagedIdentity"The standard command uses the supplied configuration.
./GraphSec-Audit.ps1The assessment produces customer, evidence and troubleshooting files.
HTML report
Overview, controls, untested items and run log.
JSON
Complete structured evidence.
CSV
Compact result list.
SHA-256 manifest
Checksums for export files.
Run log in HTML
Connections, errors, collection limitations and exports are embedded in the report.
Privacy-reduced HTML
-OmitRawEvidenceFromHtml keeps raw technical objects out of the portable HTML report.
The script is read-only by design, but some read permissions are broad.
- Use a dedicated audit app and least privilege.
- Prefer certificates or managed identities for automation.
- Treat reports and logs as confidential.
- Test every new version in a test tenant first.
Compare the three licence scopes.