PowerShell at work
See how IT, cloud and delivery teams turn object pipelines into repeatable audits, runbooks and build checks.
- Explain three real operational uses of PowerShell and the modules they require
- Separate a read-only audit from a change, with appropriate identity and permissions
- Turn inventory data into an actionable exception report
A useful production script has a source, a decision, and an output someone can act on. A daily inventory, for example, reads service or account objects, filters exceptions, and exports a report. The same pattern works on one Windows host, in a Microsoft 365 tenant, or in Azure.
| Team | Real task | PowerShell tools | Deliverable |
|---|---|---|---|
| IT operations | Find Windows services that failed to start | Get-Service, Get-WinEvent | Exception report for the on-call engineer |
| Identity administration | Review disabled Microsoft 365 accounts | Connect-MgGraph, Get-MgUser | CSV for an access review |
| Cloud operations | Inventory VMs from a scheduled Azure Automation runbook | Connect-AzAccount -Identity, Get-AzVM | Daily inventory and alert candidates |
| Delivery engineering | Reject scripts with lint or test failures | Invoke-ScriptAnalyzer, Invoke-Pester in a pwsh CI step | Passing build before release |
Those commands use different modules and permissions. The browser exercises here use sample data; they do not connect to a tenant, cloud account or production machine.
An identity audit in Microsoft 365
An identity team might review disabled accounts before a quarterly access review. The Microsoft Graph PowerShell SDK supplies Connect-MgGraph and Get-MgUser; the built-in PowerShell commands shape the report. Request only the read scope the job needs, select the properties explicitly, and keep the first version read-only. An unattended job needs its own approved app identity and permissions; an interactive Connect-MgGraph -Scopes login is for a person at the console.
1Connect-MgGraph -Scopes 'User.Read.All'
2Get-MgUser -All -Property DisplayName,UserPrincipalName,AccountEnabled |
3 Where-Object AccountEnabled -eq $false |
4 Select-Object DisplayName, UserPrincipalName, AccountEnabled |
5 Export-Csv -LiteralPath './disabled-users.csv' -NoTypeInformationAn Azure runbook and a CI gate
A cloud team can schedule a PowerShell runbook to inventory virtual machines. Inside Azure Automation, Connect-AzAccount -Identity uses the runbook’s managed identity. An identity needs an assigned role on the resources it reads. Pin the intended subscription or context in a real runbook so the report cannot quietly use the wrong one.
1$null = Disable-AzContextAutosave -Scope Process
2$context = (Connect-AzAccount -Identity).Context
3Get-AzVM -Status -DefaultProfile $context |
4 Select-Object Name, ResourceGroupName, Location, PowerStateA delivery team can run the same PowerShell code on every pull request. GitHub Actions supports shell: pwsh; the runner must have the required modules installed. The gate should fail on analyzer findings and failed Pester tests, then publish or deploy only after those checks pass.
1$findings = @(Invoke-ScriptAnalyzer -Path './scripts' -Recurse)
2if ($findings.Count) {
3 $findings | Format-Table
4 throw "PSScriptAnalyzer found $($findings.Count) issue(s)"
5}
6$tests = Invoke-Pester -Path './tests' -PassThru
7if ($tests.FailedCount) { throw "$($tests.FailedCount) test(s) failed" }Sources and next steps: Microsoft Graph PowerShell authentication, Get-MgUser, Azure Automation managed-identity runbook, GitHub Actions workflow syntax, and PSScriptAnalyzer. These are product workflows to explore locally with the required modules and access; the lab below is self-contained.
Key takeaways
Operational scripts read real objects, select exceptions, and produce a report or build signal.
Microsoft Graph and Azure Az commands require their modules, an identity, and appropriate permissions.
Start with a read-only report; make changes only with an explicit review, preview and tested error path.
CI can run
pwshwith PSScriptAnalyzer and Pester before release.
Lesson quiz
3 questions · pass with 3 correct · up to 50 XP
Passing this quiz completes the lesson and keeps your streak going. Questions you miss come back in review sessions later.
Practice: write PowerShell scripts
Write a script in the editor and run it for real against sample input, which is piped into your script as $input. Scripts run on PowerShell 6.2 through Try It Online (tio.run), a free public service, so these exercises avoid PowerShell 7-only syntax; your script and test input are sent there.
Build an access-review exception report
An identity team receives sample CSV rows as standard input with Name,UserPrincipalName,AccountEnabled,Department. Parse the CSV, keep accounts where AccountEnabled is False, and output Department: Name <UserPrincipalName> sorted by department, then name. Finish with disabled accounts: <n>.
This is a read-only stand-in for Get-MgUser. Use ConvertFrom-Csv, Where-Object, Sort-Object, and a count. No tenant access is needed.
- Mixed departments
- No exceptions
Lessons teach PowerShell 7; your script runs on PowerShell 6.2 via Try It Online (tio.run), a free public service, so stick to syntax that works there. Test input is piped into your script as $input. Your script and test input are sent to that service.
Questions about this lesson
Stuck? Ask. Figured something out? Share it. Explaining is one of the best ways to learn.
Loading posts…