### Create a Device Configuration Policy Example

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Example of creating a configuration policy with a specific name and comment.

```PowerShell
New-DeviceConfigurationPolicy -Name "Contoso Engineering" -Comment "Policy with more restrictive settings."
```

--------------------------------

### Create a Device Configuration Rule Example

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Example of creating a rule that applies to no one by using the zero-GUID.

```PowerShell
New-DeviceConfigurationRule -Policy "Contoso Engineering" -TargetGroups "00000000-0000-0000-0000-000000000000"
```

--------------------------------

### Install Microsoft Graph PowerShell SDK

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-view-device-details

Run this command in an elevated PowerShell window to install the necessary module for managing devices.

```PowerShell
Install-Module Microsoft.Graph -Scope AllUsers
```

--------------------------------

### Apply device tenant policy configuration

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-set-up

Example command to block unsupported devices and apply a specific list of security group exclusions.

```PowerShell
Set-DeviceTenantPolicy -BlockUnsupportedDevices $true -ExclusionList "6010e907-3193-4a6f-b94c-a4c24b1398cc","0be37e4a-8f43-4b9f-ab7f-74659816067a"
```

--------------------------------

### System-level instructions for MCP tool invocation

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/mrc-mcp

Use these instructions to explicitly guide AI models to utilize Release Communications MCP Server tools when answering roadmap or update queries.

```markdown
You have access to MCP tools provided by the Release Communications MCP Server:
- `get_recent_roadmaps`
- `get_roadmap_by_id`
- `get_recent_azure_updates`
- `get_azure_update_by_id`

When handling questions about Microsoft 365 Roadmap features or Azure service updates, use these tools to retrieve the most current and authoritative release information
before responding. When handling questions about Microsoft 365 product roadmap timelines, upcoming feature releases, Azure service updates, or release status for specific products (Teams, Outlook, SharePoint, Excel, etc).
```

--------------------------------

### Create Device Configuration or Conditional Access Rules

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Use these commands to associate a policy with specific security groups using their GUIDs.

```PowerShell
New-DeviceConfigurationRule -Policy "<DeviceConfigurationPolicyName>" -TargetGroups "SecurityGroupGUID1","SecurityGroupGUID2",..."SecurityGroupGUIDN" [<Access Requirement settings>] [Configuration settings] [<PowerShell exclusive settings>]
```

```PowerShell
New-DeviceConditionalAccessRule -Policy "<DeviceConfigurationPolicyName>" -TargetGroups "SecurityGroupGUID1","SecurityGroupGUID2",..."SecurityGroupGUIDN" [<Access Requirement settings>] [Configuration settings] [<PowerShell exclusive settings>]
```

--------------------------------

### Install Microsoft Graph PowerShell module

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-set-up

Installs the Microsoft Graph module for the current user to enable group management.

```PowerShell
Install-Module -Name Microsoft.Graph -Scope CurrentUser
```

--------------------------------

### Retrieve Security Group GUIDs for Rules

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Commands to install and connect to the Microsoft Graph module to identify group IDs for policy targeting.

```PowerShell
Install-Module Microsoft.Graph
```

```PowerShell
Connect-MgGraph -Scopes "Group.ReadWrite.All"
```

```PowerShell
Get-MgGroup
```

--------------------------------

### Get Photo Information via PowerShell

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/change-user-profile-photos

Retrieves metadata about an existing user or group photo. Returns an error if no photo is found.

```PowerShell
Get-MgUserPhoto -UserId <UPN>
```

```PowerShell
Get-MgUserPhoto -UserId albertas@contoso.onmicrosoft.com
```

```PowerShell
Get-MgGroupPhoto -GroupId <ID>
```

```PowerShell
Get-MgGroupPhoto -GroupId 173cd812-5563-439c-9da4-bc2715fa2aee
```

--------------------------------

### View full exclusion list

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-set-up

Expands the ExclusionList property to display all security group GUIDs if they appear truncated.

```PowerShell
Get-DeviceTenantRule | Select-Object -ExpandProperty ExclusionList
```

--------------------------------

### Retrieve security groups

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-set-up

Lists available security groups to identify the Id (GUID) values required for the exclusion list.

```PowerShell
Get-MgGroup
```

--------------------------------

### Get Focused Inbox status

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/setup/configure-focused-inbox

Retrieves the current Focused Inbox configuration for a specific user.

```PowerShell
Get-FocusedInbox -Identity <tim@contoso.com>
```

--------------------------------

### Retrieve Correlation ID from HTML source

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/centralized-deployment-of-add-ins

Example of the hidden input field containing the Correlation ID used for troubleshooting Microsoft 365 web app issues.

```html
<input name=" **wdCorrelationId**" type="hidden" value=" **{BC17079E-505F-3000-C177-26A8E27EB623}**">
<input name="user_id" type="hidden" value="1003bffd96933623"></form>
```

--------------------------------

### Enable Basic Mobility and Security with PowerShell

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-set-up

Use these commands to initialize the device tenant policy and rule if they are not already present.

```PowerShell
New-DeviceTenantPolicy

New-DeviceTenantRule -ExclusionList 00000000-0000-0000-0000-000000000000
```

--------------------------------

### Execute the Compatibility Check

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/centralized-deployment-of-add-ins

Run the compatibility check command to verify tenant readiness, which requires tenant domain and admin credentials.

```PowerShell
Invoke-CompatibilityCheck
```

--------------------------------

### Import the Compatibility Checker Module

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/centralized-deployment-of-add-ins

Load the O365CompatibilityChecker module into the current PowerShell session.

```PowerShell
Import-Module O365CompatibilityChecker
```

--------------------------------

### Verify Basic Mobility and Security status with PowerShell

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-set-up

Run these commands to check if a device tenant policy and rule are already configured in the organization.

```PowerShell
Write-Output -InputObject `r`n,"Device tenant policy",("-"*25); Get-DeviceTenantPolicy | Format-Table Name; Write-Output -InputObject "Device tenant rule",("-"*25); Get-DeviceTenantRule | Format-List Name,ExclusionList,BlockUnsupportedDevices
```

--------------------------------

### Check and Enable AppsForOffice

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/centralized-deployment-of-add-ins

Commands to check the current organization configuration for add-ins and enable them if disabled.

```powershell
Get-OrganizationConfig | fl AppsForOfficeEnabled
```

```powershell
Set-OrganizationConfig -AppsForOfficeEnabled:$True
```

--------------------------------

### View Summary of Device Rules

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Retrieve a list of device configuration or conditional access rules.

```PowerShell
Get-DeviceConfigurationRule | Format-Table Name,TargetGroups,Mode
```

```PowerShell
Get-DeviceConditionalAccessRule | Format-Table Name,TargetGroups,Mode
```

--------------------------------

### Evaluate an authenticated server with custom output

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-tools-for-agent

Sets an authentication token via environment variable and specifies a custom output directory for artifacts.

```PowerShell
$env:A365_MCP_AUTH_TOKEN = "<bearer-token>"
a365 develop-mcp evaluate --server-url "https://my-mcp-server.contoso.com/mcp" --output-dir "./eval"
```

--------------------------------

### Register MCP Server with APIKey (Query Parameter)

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-tools-for-agent

Registers an MCP server using an API key passed as a query parameter.

```bash
a365 develop-mcp register-external-mcp-server \
--server-name "ZavaServer" \
--server-url "https://mcp.zava.com/mcp" \
--publisher "Contoso" \
--description "My external MCP server for document search" \
--auth-type APIKey \
--api-key-location Query \
--api-key-name apiKey \
--tools "tool1,tool2"
```

```json
{
  "serverName": "ext_MarketData",
  "serverUrl": "https://api.contoso.com/market/mcp",
  "authType": "APIKey",
  "description": "Real-time stock market data and search from Contoso Market Services.",
  "publisherName": "Contoso",
  "tools": [
    {
      "name": "stock-market-data",
      "description": "Get real-time stock market data and financial information."
    },
    {
      "name": "real-time-search",
      "description": "Search the web for real-time information and news."
    }
  ],
  "remoteScopes": null,
  "externalOAuth": null,
  "apiKey": {
    "location": "Query",
    "name": "apiKey"
  }
}
```

--------------------------------

### Configure device tenant policy syntax

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-set-up

Syntax for updating the device tenant policy, including blocking unsupported devices and defining an exclusion list.

```PowerShell
Set-DeviceTenantPolicy [-BlockUnsupportedDevices <$true | $false>] [-ExclusionList "SecurityGroupGUID1","SecurityGroupGUID2",..."SecurityGroupGUIDN"]
```

--------------------------------

### View Summary of Device Policies

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Retrieve a list of device configuration or conditional access policies.

```PowerShell
Get-DeviceConfigurationPolicy | Format-Table Name,Enabled
```

```PowerShell
Get-DeviceConditionalAccessPolicy | Format-Table Name,Enabled
```

```PowerShell
Get-DevicePolicy | Format-Table Name,Type,Enabled
```

--------------------------------

### New-DeviceConfigurationPolicy

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Creates a new device configuration policy to allow access.

```APIDOC
## New-DeviceConfigurationPolicy

### Description
Creates a new device configuration policy.

### Parameters
- **Name** (String) - Required - The name of the policy.
- **Comment** (String) - Optional - An optional comment for the policy.
- **Enabled** (Boolean) - Optional - Specifies if the policy is enabled ($true) or disabled ($false).
```

--------------------------------

### Run the Device Ownership Script

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-view-device-details

Syntax for executing the script with optional parameters for user filtering and file export.

```PowerShell
& <path to script>\Get-MgGraphDeviceOwnership.ps1 [-Users <UserIds>] [-Export] [-ExportPath "<File path>"] [-ExportFileName "<FileName>"]
```

--------------------------------

### New-DeviceConfigurationRule

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Creates a device configuration rule to associate a policy with target security groups.

```APIDOC
## New-DeviceConfigurationRule

### Description
Creates a device configuration rule to apply a policy to specific security groups.

### Parameters
- **Policy** (String) - Required - The name of the device configuration policy.
- **TargetGroups** (String[]) - Required - A comma-separated list of security group GUIDs to which the policy applies.
```

--------------------------------

### View current device tenant rule settings

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-set-up

Retrieves the current status of device tenant rules, including unsupported device blocking and the exclusion list.

```PowerShell
Get-DeviceTenantRule | Format-List BlockUnsupportedDevices,ExclusionList
```

--------------------------------

### Create Device Configuration or Conditional Access Policies

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Use these commands to define new device policies. Note that the policy name cannot be changed after creation.

```PowerShell
New-DeviceConfigurationPolicy -Name "<PolicyName>" [-Comment "<OptionalComment>"] [-Enabled <$true | false>]
```

```PowerShell
New-DeviceConditionalAccessPolicy -Name "<PolicyName>" [-Comment "<OptionalComment>"] [-Enabled <$true | false>]
```

--------------------------------

### Register MCP Server with APIKey (Header)

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-tools-for-agent

Registers an MCP server using an API key passed in a request header.

```bash
a365 develop-mcp register-external-mcp-server \
--server-name "ZavaServer" \
--server-url "https://mcp.zava.com/mcp" \
--publisher "Contoso" \
--description "My external MCP server for document search" \
--auth-type APIKey \
--api-key-location Header \
--api-key-name token \
--tools "tool1,tool2"
```

```json
{
  "serverName": "ext_InternalTools",
  "serverUrl": "https://tools.contoso.com/mcp",
  "authType": "APIKey",
  "description": "Contoso internal tools MCP Server with API key authentication.",
  "publisherName": "Contoso",
  "tools": [
    {
      "name": "tool1",
      "description": "First tool exposed by the server."
    },
    {
      "name": "tool2",
      "description": "Second tool exposed by the server."
    }
  ],
  "remoteScopes": null,
  "externalOAuth": null,
  "apiKey": {
    "location": "Header",
    "name": "X-API-Key"
  }
}
```

--------------------------------

### Initialize cache and client secret

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/resolve-site-urls

Validates report paths and prompts the user for a secure client secret.

```PowerShell
if ($reportPaths.Count -eq 0) {
  Write-Host "Please provide at least one report path" -ForegroundColor Red
  exit
}
$cache = New-Object 'System.Collections.Generic.Dictionary[[String],[String]]'
$clientSecret = Read-Host "Please enter client secret" -AsSecureString
```

--------------------------------

### Monitor MCP server activity with KQL

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-tools-for-agent

Use this KQL query in Microsoft Defender advanced hunting to track tool execution events and identify specific MCP server usage.

```Kusto
CloudAppEvents
| where ActionType in ( "ExecuteToolByGateway")
| where RawEventData contains "tool name"
```

--------------------------------

### Register MCP Server with NoAuth

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-tools-for-agent

Registers an MCP server that does not require authentication.

```bash
a365 develop-mcp register-external-mcp-server \
--server-name "ZavaServer" \
--server-url "https://mcp.zava.com/mcp" \
--publisher "Contoso" \
--description "My external MCP server for document search" \
--auth-type "NoAuth" \
--tools "tool1,tool2"
```

```json
{
  "serverName": "ext_DocsSearch",
  "serverUrl": "https://docs.contoso.com/api/mcp",
  "authType": "NoAuth",
  "description": "Documentation search MCP Server for Contoso developer docs.",
  "publisherName": "Contoso",
  "tools": [
    {
      "name": "search_docs",
      "description": "Search Contoso developer documentation and code samples."
    }
  ],
  "remoteScopes": null,
  "externalOAuth": null,
  "apiKey": null
}
```

--------------------------------

### Generate evaluation checklist only

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-tools-for-agent

Skips agent probing to generate a checklist file for manual scoring with a custom LLM.

```PowerShell
a365 develop-mcp evaluate --server-url "https://my-mcp-server.contoso.com/mcp" --eval-engine none
```

--------------------------------

### Register External MCP Server with ExternalOAuth

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-tools-for-agent

Use the CLI or a JSON configuration file to register an MCP server that authenticates via an external OAuth provider.

```Bash
a365 develop-mcp register-external-mcp-server \
--server-name "ZavaServer" \
--server-url "https://zava.com/mcp" \
--publisher "Contoso" \
--description "My external MCP server for document search" \
--auth-type ExternalOAuth \
--idp-authorization-url "https://idp.zava.com/o/oauth2/v2/auth" \
--idp-token-url "https://idp.zava.com/oauth2/token" \
--idp-scopes "https://api.zava.com/read" \
--idp-client-id "<your-client-id>" \
--idp-client-secret "<your-client-secret>" \
--remote-scopes "https://api.zava.com/read" \
--tools "tool1,tool2"
```

```JSON
{
  "serverName": "ext_Analytics",
  "serverUrl": "https://analytics.contoso.com/mcp",
  "authType": "ExternalOAuth",
  "description": "Contoso Analytics MCP Server for dataset and query operations.",
  "publisherName": "Contoso",
  "tools": [
    {
      "name": "list_datasets",
      "description": "List all available analytics datasets."
    }
  ],
  "remoteScopes": "https://analytics.contoso.com/.default",
  "externalOAuth": {
    "authorizationUrl": "https://auth.contoso.com/oauth2/authorize",
    "tokenUrl": "https://auth.contoso.com/oauth2/token",
    "scopes": "https://analytics.contoso.com/.default",
    "clientId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "clientSecret": "<your-client-secret>"
  },
  "apiKey": null
}
```

--------------------------------

### Evaluate a local MCP server

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-tools-for-agent

Runs an evaluation on a local server using automatic engine selection.

```PowerShell
a365 develop-mcp evaluate --server-url "http://localhost:5000/mcp"
```

--------------------------------

### Enable Clutter for a user

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/email/configure-clutter

Use the Set-Clutter cmdlet to enable the Clutter feature for a specific mailbox.

```PowerShell
Set-Clutter -Identity "Allie Bellew" -Enable $true
```

--------------------------------

### View priority accounts with PowerShell

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/priority-accounts

Retrieves a list of all users currently tagged as priority accounts.

```PowerShell
Get-User -IsVIP | Select-Object Identity
```

--------------------------------

### Retrieve device details using Get-MgDevice

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-view-device-details

Fetches all devices that have registered owners from the Microsoft Graph API.

```PowerShell
Get-MgDevice -All -ExpandProperty "registeredOwners" | Where-Object {($_.RegisteredOwners -ne $null) -and ($_.RegisteredOwners.Count -gt 0)}
```

--------------------------------

### Add a user to priority accounts with PowerShell

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/priority-accounts

Updates a user's status to priority account by setting the VIP flag to true.

```PowerShell
Set-User -VIP $true -Identity <Identity> -Confirm:$false
```

--------------------------------

### Connect to Microsoft Graph

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/create-groups/manage-groups

Establishes a connection to Microsoft Graph with the necessary permissions to manage groups.

```PowerShell
Connect-MgGraph -Scopes "Group.ReadWrite.All"
```

--------------------------------

### Get-DeviceConfigurationRule

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Retrieves the target groups for a device configuration rule.

```APIDOC
## Get-DeviceConfigurationRule

### Description
Retrieves the existing TargetGroups for a specified device configuration rule.

### Parameters
- **Identity** (string) - Required - The name of the rule.
```

--------------------------------

### CNAME record configuration syntax

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-set-up

The required DNS CNAME records for custom domain enrollment in Basic Mobility and Security.

```text
Hostname: EnterpriseEnrollment.company_domain.com
Points to address or value: EnterpriseEnrollment-s.manage.microsoft.us

Hostname: EnterpriseRegistration.company_domain.com
Points to address or value: EnterpriseRegistration.windows.net
```

```text
Hostname: EnterpriseEnrollment.contoso.com
Points to address or value: EnterpriseEnrollment-s.manage.microsoft.us

Hostname: EnterpriseRegistration.contoso.com
Points to address or value: EnterpriseRegistration.windows.net
```

--------------------------------

### Register External MCP Server with EntraOAuth

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-tools-for-agent

Use the CLI or a JSON configuration file to register an MCP server that authenticates via Microsoft Entra ID.

```Bash
a365 develop-mcp register-external-mcp-server \
--server-name "ZavaServer" \
--server-url "https://mcp.zava.com/mcp" \
--publisher "Contoso" \
--description "My external MCP server for document search" \
--auth-type EntraOAuth \
--remote-scopes "https://api.zava.com/.default" \
--tools "tool1,tool2"
```

```JSON
{
  "serverName": "ext_OrgDirectory",
  "serverUrl": "https://directory.contoso.com/mcp",
  "authType": "EntraOAuth",
  "description": "Contoso organization directory MCP Server secured with Entra OAuth.",
  "publisherName": "Contoso",
  "tools": [
    {
      "name": "list_users",
      "description": "List users in the organization directory."
    },
    {
      "name": "get_user_profile",
      "description": "Get the profile of a specific user by ID or UPN."
    }
  ],
  "remoteScopes": "api://contoso-directory/.default",
  "externalOAuth": null,
  "apiKey": null
}
```

--------------------------------

### Download User or Group Photos via PowerShell

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/change-user-profile-photos

Saves an existing user or group photo to a local file path.

```PowerShell
Get-MgUserPhotoContent -UserId <UPN> -OutFile "<PhotoPathAndFileName>
```

```PowerShell
Get-MgUserPhotoContent -UserId albertas@contoso.onmicrosoft.com -OutFile "C:\Download\Alberta Sanchez.png"
```

```PowerShell
Get-MgGroupPhotoContent -GroupId <ID> -OutFile "<PhotoPathAndFileName>
```

```PowerShell
Get-MgGroupPhotoContent -GroupId 173cd812-5563-439c-9da4-bc2715fa2aee -OutFile "C:\Download\Sales Department.png"
```

--------------------------------

### Manage Litigation Hold via PowerShell

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/misc/create-litigation-hold-mac

Commands to enable, configure, and verify litigation holds for Exchange Online mailboxes.

```PowerShell
Set-Mailbox <username> -LitigationHoldEnabled $true
```

```PowerShell
Set-Mailbox <username> -LitigationHoldEnabled $true -LitigationHoldDuration <number of days>
```

```PowerShell
Get-Mailbox <username> | FL LitigationHoldEnabled
```

--------------------------------

### Add User or Group Photos via PowerShell

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/change-user-profile-photos

Uploads a photo file to a specific user or group profile.

```PowerShell
Set-MgUserPhotoContent -UserId <UPN> -InFile "<PhotoPathAndFileName>"
```

```PowerShell
Set-MgUserPhotoContent -UserId albertas@contoso.onmicrosoft.com -InFile "C:\Upload\Alberta Sanchez.png"
```

```PowerShell
Set-MgGroupPhotoContent -GroupId <ID> -InFile "<PhotoPathAndFileName>"
```

```PowerShell
Set-MgGroupPhotoContent -GroupId 173cd812-5563-439c-9da4-bc2715fa2aee -InFile "C:\Upload\Sales Department.png"
```

--------------------------------

### Connect to Microsoft Graph PowerShell

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/change-user-profile-photos

Establishes a connection to the Microsoft Graph API with the necessary permissions for managing user or group photos.

```PowerShell
Connect-MgGraph -Scopes "User.ReadWrite.All"
```

```PowerShell
Connect-MgGraph -Scopes "Group.ReadWrite.All"
```

```PowerShell
Connect-MgGraph -Scopes "User.ReadWrite.All","Group.ReadWrite.All"
```

--------------------------------

### New-DeviceConditionalAccessPolicy

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Creates a new device conditional access policy to block access.

```APIDOC
## New-DeviceConditionalAccessPolicy

### Description
Creates a new device conditional access policy.

### Parameters
- **Name** (String) - Required - The name of the policy.
- **Comment** (String) - Optional - An optional comment for the policy.
- **Enabled** (Boolean) - Optional - Specifies if the policy is enabled ($true) or disabled ($false).
```

--------------------------------

### New-DeviceConditionalAccessRule

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Creates a device conditional access rule to associate a policy with target security groups.

```APIDOC
## New-DeviceConditionalAccessRule

### Description
Creates a device conditional access rule to apply a policy to specific security groups.

### Parameters
- **Policy** (String) - Required - The name of the device configuration policy.
- **TargetGroups** (String[]) - Required - A comma-separated list of security group GUIDs to which the policy applies.
```

--------------------------------

### Get-MgUserPhotoContent

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/change-user-profile-photos

Downloads the profile photo of a user to a local file.

```APIDOC
## Get-MgUserPhotoContent

### Description
Downloads the user's profile photo to the specified local path.

### Syntax
`Get-MgUserPhotoContent -UserId <UPN> -OutFile "<PhotoPathAndFileName>"`

### Example
`Get-MgUserPhotoContent -UserId albertas@contoso.onmicrosoft.com -OutFile "C:\Download\Alberta Sanchez.png"`
```

--------------------------------

### Update Activity Reports with Site URLs via PowerShell

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/resolve-site-urls

Executes the report update script using tenant and client credentials. Requires the secret value to be provided during execution.

```powershell
.\Update-Report.ps1 -**tenantId** {tenant id above} -**clientId** {client id above} -**reportPaths** @("file path for report #1", "file path for report #2")
```

--------------------------------

### Connect to Microsoft Graph PowerShell

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-view-device-details

Establishes a connection to the Microsoft 365 organization with the necessary permissions to read device and user information.

```PowerShell
Connect-MgGraph -Scopes Device.Read.All,User.Read.All
```

--------------------------------

### Define Update-Report parameters and authentication function

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/resolve-site-urls

Defines the script parameters and a helper function to retrieve an OAuth 2.0 access token using client credentials.

```PowerShell
 param(
 [Parameter(Mandatory=$true)]
 [string]$tenantId,
 [Parameter(Mandatory=$true)]
 [string]$clientId,
 [Parameter(Mandatory=$false)]
 [string[]]$reportPaths
)

function Get-AccessToken {
 param(
     [Parameter(Mandatory=$true)]
     [string]$tenantId,
     [Parameter(Mandatory=$true)]
     [string]$clientId,
     [Parameter(Mandatory=$true)]
     [System.Security.SecureString]$clientSecret,
     [Parameter(Mandatory=$false)]
     [string]$scope = "https://graph.microsoft.com/.default"
 )

 $tokenEndpoint = "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token"
 $tokenRequest = @{
     client_id     = $clientId
     scope         = $scope
     client_secret = ConvertFrom-SecureString $clientSecret -AsPlainText
     grant_type    = "client_credentials"
 }

 $tokenResponse = Invoke-RestMethod -Uri $tokenEndpoint -Method Post -Body $tokenRequest
 return $tokenResponse.access_token
}
```

--------------------------------

### Verify OAuth Connectivity

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/centralized-deployment-of-add-ins

Use this PowerShell cmdlet to verify OAuth connectivity for a specific user.

```powershell
Test-OAuthConnectivity
```

--------------------------------

### Fetch site information from Graph API

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/resolve-site-urls

Retrieves site IDs and URLs from the Microsoft Graph API and stores them in a dictionary cache.

```PowerShell
Write-Host
Write-Host "Getting information for all the sites..." -ForegroundColor Cyan

$uri = "https://graph.microsoft.com/v1.0/sites/getAllSites?`$select=sharepointIds&`$top=10000"
while ($uri -ne $null) {

  Write-Host $uri

  $isSuccess = $false
  while (-not $isSuccess) {
      try {
          $accessToken = Get-AccessToken -tenantId $tenantId -clientId $clientId -clientSecret $clientSecret
          $restParams = @{Headers=@{Authorization="Bearer $accessToken"}}
      }
      catch {
          Write-Host "Retrying...  $($_.Exception.Message)" -ForegroundColor Yellow
          continue
      }
      try {
          $sites = Invoke-RestMethod $uri @restParams
          $isSuccess = $true
      }
      catch {
          if ($_.Exception.Response -and $_.Exception.Response.Headers['Retry-After']) {
              $retryAfter = [int]$_.Exception.Response.Headers['Retry-After']
              Write-Output "Waiting for $retryAfter seconds before retrying..." -ForegroundColor Yellow
              Start-Sleep -Seconds $retryAfter
          }
          Write-Host "Retrying...  $($_.Exception.Message)" -ForegroundColor Yellow
          continue
      }
  }

  $sites.value | ForEach-Object {
      $cache[$_.sharepointIds.siteId] = $_.sharepointIds.siteUrl
  }

  $uri = $sites."@odata.nextLink"

  Write-Host "Total sites received: $($cache.Count)"
}
```

--------------------------------

### Set-DeviceConfigurationRule

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Modifies an existing device configuration rule.

```APIDOC
## Set-DeviceConfigurationRule

### Description
Modifies an existing device configuration rule (Allow access).

### Parameters
- **Identity** (string) - Required - The name of the rule to modify.
- **TargetGroups** (string[]) - Required - A list of Security Group GUIDs to target. This parameter overwrites existing values.
```

--------------------------------

### View Detailed Device Policy Information

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Retrieve specific details for a device policy by its identity.

```PowerShell
Get-DeviceConfigurationPolicy -Identity "<PolicyName>"
```

```PowerShell
Get-DeviceConditionalAccessPolicy -Identity "<PolicyName>"
```

```PowerShell
Get-DevicePolicy -Identity "<PolicyName>"
```

```PowerShell
Get-DeviceConfigurationPolicy -Identity "Executives"
```

--------------------------------

### Modify Device Configuration and Conditional Access Rules

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Use these commands to update existing device configuration or conditional access rules. Note that the TargetGroups parameter overwrites existing values.

```PowerShell
Set-DeviceConfigurationRule -Identity "<RuleName>" -TargetGroups "SecurityGroupGUID1","SecurityGroupGUID2",..."SecurityGroupGUIDN" [<Access Requirement settings>] [Configuration settings] [<PowerShell exclusive settings>]
```

```PowerShell
Set-DeviceConditionalAccessRule -Identity "<RuleName>" -TargetGroups "SecurityGroupGUID1","SecurityGroupGUID2",..."SecurityGroupGUIDN" [-AllowJailBroken <$true | $false>] [<Other Access Requirement settings>] [Configuration settings] [<PowerShell exclusive settings>]
```

--------------------------------

### Retrieve Target Groups for Device Rules

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Use these commands to view the current target groups assigned to a specific device rule before performing an update.

```PowerShell
Get-DeviceConfigurationRule -Identity "<RuleIdentity>" | Select-Object -ExpandProperty TargetGroups
```

```PowerShell
Get-DeviceConditionalAccessRule -Identity "<RuleIdentity>" | Select-Object -ExpandProperty TargetGroups
```

--------------------------------

### Analyze Folder Sizes for User Data

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/create-groups/group-mailbox-size-management

Identify specific folders contributing to the 'User' quota calculation within the group mailbox.

```PowerShell
Get-MailboxFolderStatistics <groupname> | where { $_.TargetQuota -like 'User' } | ft Name,FolderPath,FolderType,FolderSize 

Get-MailboxFolderStatistics <groupname> -FolderScope NonIPMRoot | where { $_.TargetQuota -like 'User' } | ft Name,FolderType,*size* 
```

--------------------------------

### View Detailed Device Rule Information

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Retrieve specific details for a device rule by its identity, including filtering properties.

```PowerShell
Get-DeviceConfigurationRule -Identity "<RuleName>" | Format-List [<Specific properties to view>]
```

```PowerShell
Get-DeviceConditionalAccessRule -Identity "<RuleName>" | Format-List [<Specific properties to view>]
```

```PowerShell
Get-DeviceConfigurationRule -Identity "Executives{2b18}"
```

```PowerShell
Get-DeviceConfigurationRule -Identity "Executives{2b18}" | Format-List TargetGroups,*Password*
```

```PowerShell
Get-DeviceConfigurationRule -Identity "Executives{2b18}" | Select-Object -ExpandProperty TargetGroups
```

--------------------------------

### Get-MgGroupPhotoContent

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/change-user-profile-photos

Downloads the profile photo of a group to a local file.

```APIDOC
## Get-MgGroupPhotoContent

### Description
Downloads the group's profile photo to the specified local path.

### Syntax
`Get-MgGroupPhotoContent -GroupId <ID> -OutFile "<PhotoPathAndFileName>"`

### Example
`Get-MgGroupPhotoContent -GroupId 173cd812-5563-439c-9da4-bc2715fa2aee -OutFile "C:\Download\Sales Department.png"`
```

--------------------------------

### Retrieve device details for a specific user

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-view-device-details

Uses the Users parameter to fetch device information for a single specified user.

```PowerShell
& C:\My Documents\Get-MgGraphDeviceOwnership.ps1 -Users (Get-MgUser -UserId "laura@contoso.com")
```

--------------------------------

### Connect to Microsoft Graph PowerShell

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/resend-user-password

Establishes a connection to Microsoft Entra ID with the necessary permissions to read user data.

```PowerShell
Connect-MgGraph -Scopes "User.Read.All"
```

--------------------------------

### Codex MCP Configuration

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/mrc-mcp

Command to add the MRC MCP server to Codex via the command line.

```bash
codex mcp add mrc-mcp --url https://www.microsoft.com/releasecommunications/mcp
```

--------------------------------

### Get-MgGraphDeviceOwnership PowerShell Script

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-view-device-details

A script to retrieve device details and registered owners, with optional filtering by user and CSV export capabilities.

```PowerShell
param (
    [Parameter(Mandatory = $false)]
    [PSObject[]]$Users = @(),
    [Parameter(Mandatory = $false)]
    [Switch]$Export,
    [Parameter(Mandatory = $false)]
    [String]$ExportFileName = "UserDeviceOwnership_" + (Get-Date -Format "yyMMdd_HHMMss") + ".csv",
    [Parameter(Mandatory = $false)]
    [String]$ExportPath = [Environment]::GetFolderPath("Desktop")
)

#Clearing the screen
Clear-Host

#Preparing the output object
$deviceOwnership = @()


if ($users.Count -eq 0) {
    Write-Output "No user has been provided, gathering data for all devices in the tenant"
    #Getting all Devices and their registered owners
    $devices = Get-MgDevice -All -Property * -ExpandProperty registeredOwners

    #For each device which has a registered owner, extract the device data and the registered owner data
    foreach ($device in $devices) {
        $DeviceOwners = $device | Select-Object -ExpandProperty 'RegisteredOwners'
        #Checking if the DeviceOwners Object is empty
        if ($DeviceOwners -ne $null) {
            foreach ($DeviceOwner in $DeviceOwners) {
                $OwnerDictionary = $DeviceOwner.AdditionalProperties
                $OwnerDisplayName = $OwnerDictionary.Item('displayName')
                $OwnerUPN = $OwnerDictionary.Item('userPrincipalName')
                $OwnerID = $deviceOwner.Id
                $deviceOwnership += [PSCustomObject]@{
                    DeviceDisplayName             = $device.DisplayName
                    DeviceId                      = $device.DeviceId
                    DeviceOSType                  = $device.OperatingSystem
                    DeviceOSVersion               = $device.OperatingSystemVersion
                    DeviceTrustLevel              = $device.TrustType
                    DeviceIsCompliant             = $device.IsCompliant
                    DeviceIsManaged               = $device.IsManaged
                    DeviceObjectId                = $device.Id
                    DeviceOwnerID                 = $OwnerID
                    DeviceOwnerDisplayName        = $OwnerDisplayName
                    DeviceOwnerUPN                = $OwnerUPN
                    ApproximateLastLogonTimestamp = $device.ApproximateLastSignInDateTime
                }
            }
        }

    }
}

else {
    #Checking that userid is present in the users object
    Write-Output "List of users has been provided, gathering data for all devices owned by the provided users"
    foreach ($user in $users) {
        $devices = Get-MgUserOwnedDevice -UserId $user.Id -Property *
        foreach ($device in $devices) {
            $DeviceHashTable = $device.AdditionalProperties
            $deviceOwnership += [PSCustomObject]@{
                DeviceId                      = $DeviceHashTable.Item('deviceId')
                DeviceOSType                  = $DeviceHashTable.Item('operatingSystem')
                DeviceOSVersion               = $DeviceHashTable.Item('operatingSystemVersion')
                DeviceTrustLevel              = $DeviceHashTable.Item('trustType')
                DeviceDisplayName             = $DeviceHashTable.Item('displayName')
                DeviceIsCompliant             = if ($DeviceHashTable.ContainsKey('isCompliant')) {$DeviceHashTable.Item('isCompliant')} else {$null}
                DeviceIsManaged               = if ($DeviceHashTable.ContainsKey('isManaged')) {$DeviceHashTable.Item('isManaged')} else {$null}
                DeviceObjectId                = $device.Id
                DeviceOwnerUPN                = $user.UserPrincipalName
                DeviceOwnerID                 = $user.Id
                DeviceOwnerDisplayName        = $user.DisplayName
                ApproximateLastLogonTimestamp = $DeviceHashTable.Item('approximateLastSignInDateTime')
            }
        }
    }

}

$deviceOwnership

if ($export) {
    $exportFile = Join-Path -Path $exportPath -ChildPath $exportFileName
    $deviceOwnership | Export-Csv -Path $exportFile -NoTypeInformation
    Write-Output "Data has been exported to $exportFile"
}
```

--------------------------------

### Retrieve and export device details for a security group

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-view-device-details

Fetches device details for all members of a specific security group and exports the output to a designated CSV file.

```PowerShell
$groupId = Get-MgGroup -Filter "displayName eq 'FinanceStaff'" | Select-Object -ExpandProperty Id

$Users = Get-MgGroupMember -GroupId $groupId | Select-Object -ExpandProperty Id | ForEach-Object {Get-MgUser -UserId $_}

& C:\My Documents\Get-MgGraphDeviceOwnership.ps1 -User $Users -Export -ExportPath "C:\My Documents" -ExportFileName "Contoso FinanceStaff Devices 2024-12-19.csv"
```

--------------------------------

### Remove Device Configuration and Conditional Access Policies

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Use these commands to remove device policies. Removing a policy also marks the associated device rule for deletion.

```PowerShell
Remove-DeviceConfigurationPolicy -Identity "<PolicyName>"
```

```PowerShell
Remove-DeviceConditionalAccessPolicy -Identity "<PolicyName>"
```

```PowerShell
Remove-DeviceConfigurationPolicy -Identity "Marketing Department"
```

--------------------------------

### Check Focused Inbox configuration

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/setup/configure-focused-inbox

Retrieves the current organization configuration to verify the status of the FocusedInboxOn setting.

```PowerShell
Get-OrganizationConfig
```

--------------------------------

### Set-MgUserPhotoContent

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/change-user-profile-photos

Uploads or updates a profile photo for a specific user.

```APIDOC
## Set-MgUserPhotoContent

### Description
Updates the profile photo for a user identified by their UPN.

### Syntax
`Set-MgUserPhotoContent -UserId <UPN> -InFile "<PhotoPathAndFileName>"`

### Example
`Set-MgUserPhotoContent -UserId albertas@contoso.onmicrosoft.com -InFile "C:\Upload\Alberta Sanchez.png"`
```

--------------------------------

### Create a Transport Rule with PowerShell

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/setup/configure-focused-inbox

Use this command to create a transport rule that forces messages from a specific sender into the Focused Inbox.

```PowerShell
New-TransportRule -Name <name_of_the_rule> -From "Payroll Department" -SetHeaderName "X-MS-Exchange-Organization-BypassFocusedInbox" -SetHeaderValue "true"
```

--------------------------------

### Disable Clutter for a user

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/email/configure-clutter

Use the Set-Clutter cmdlet with the -Enable parameter set to $false to disable Clutter for a specific mailbox.

```PowerShell
Set-Clutter -Identity "Allie Bellew" -Enable $false
```

--------------------------------

### Remove-DeviceConfigurationRule

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Removes a device configuration rule.

```APIDOC
## Remove-DeviceConfigurationRule

### Description
Removes a device configuration rule (Allow access).

### Parameters
- **Identity** (string) - Required - The name of the rule to remove.
```

--------------------------------

### Standard MCP Server Configuration

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/mrc-mcp

The standard JSON configuration block used to register the MRC MCP server in most compatible AI clients.

```json
{
  "servers": {
    "MRC-MCP-Server": {
      "type": "http",
      "url": "https://www.microsoft.com/releasecommunications/mcp"
    }
  }
}
```

--------------------------------

### Get-MgUserPhoto

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/change-user-profile-photos

Retrieves metadata information about a user's profile photo.

```APIDOC
## Get-MgUserPhoto

### Description
Returns metadata (Id, Height, Width) for the user's existing photo.

### Syntax
`Get-MgUserPhoto -UserId <UPN>`

### Example
`Get-MgUserPhoto -UserId albertas@contoso.onmicrosoft.com`
```

--------------------------------

### List Deleted Groups

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/create-groups/manage-groups

Retrieves a list of groups that have been soft-deleted and are currently in the recycle bin.

```PowerShell
Get-MgDirectoryDeletedGroup
```

--------------------------------

### Remove Device Configuration and Conditional Access Rules

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Use these commands to remove specific device rules. Note that removing a rule does not automatically remove the associated policy.

```PowerShell
Remove-DeviceConfigurationRule -Identity "<PolicyName>"
```

```PowerShell
Remove-DeviceConditionalAccessRule -Identity "<PolicyName>"
```

```PowerShell
Remove-DeviceConfigurationRule -Identity "Marketing Department"
```

--------------------------------

### Set-MgGroupPhotoContent

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/change-user-profile-photos

Uploads or updates a profile photo for a specific Microsoft 365 group.

```APIDOC
## Set-MgGroupPhotoContent

### Description
Updates the profile photo for a Microsoft 365 group identified by its ID.

### Syntax
`Set-MgGroupPhotoContent -GroupId <ID> -InFile "<PhotoPathAndFileName>"`

### Example
`Set-MgGroupPhotoContent -GroupId 173cd812-5563-439c-9da4-bc2715fa2aee -InFile "C:\Upload\Sales Department.png"`
```

--------------------------------

### Get-DeviceConditionalAccessRule

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Retrieves the target groups for a device conditional access rule.

```APIDOC
## Get-DeviceConditionalAccessRule

### Description
Retrieves the existing TargetGroups for a specified device conditional access rule.

### Parameters
- **Identity** (string) - Required - The name of the rule.
```

--------------------------------

### Update report using cached site info

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/resolve-site-urls

Processes CSV files to replace site IDs with resolved URLs using the populated cache.

```PowerShell
foreach ($reportPath in $reportPaths) {
  Write-Host
  Write-Host "Updating report $($reportPath) ..." -ForegroundColor Cyan

  $outputPath = "$($reportPath)_$([Math]::Floor((Get-Date -UFormat %s))).csv"
  $writer = [System.IO.StreamWriter]::new($outputPath)
  $reader = [System.IO.StreamReader]::new($reportPath)
  $rowCount = 0

  while ($null -ne ($line = $reader.ReadLine())) {
      $rowCount++

      $columns = $line.Split(",")
      $siteId = $columns[1]

      $_guid = New-Object System.Guid
      if ([System.Guid]::TryParse($siteId, [ref]$_guid)) {
          $siteUrl = $cache[$siteId]
          $columns[2] = $siteUrl
          $line = $columns -join ","
      }
      
      $writer.WriteLine($line)

      if ($rowCount%1000 -eq 0) {
          Write-Host "Processed $($rowCount) rows"
      }
  }
  $writer.Close()
  $reader.Close()

  Write-Host "Processed $($rowCount) rows"
  Write-Host "Report updated: $($outputPath)" -ForegroundColor Cyan
}
```

--------------------------------

### Modify Device Policies

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Update settings for existing device policies, such as comments or enabled status.

```PowerShell
Set-DeviceConfigurationPolicy -Identity "<PolicyName>" [-Comment "<OptionalComment>"] [-Enabled <$true | $false>]
```

```PowerShell
Set-DeviceConditionalAccessPolicy -Identity "<PolicyName>" [-Comment "<OptionalComment>"] [-Enabled <$true | $false>]
```

```PowerShell
Set-DeviceConfigurationPolicy -Identity "Executives" -Enabled $false
```

--------------------------------

### get_recent_roadmaps

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/mrc-mcp

Retrieves Microsoft 365 roadmap posts from Microsoft Release Communications with optional filtering and search capabilities.

```APIDOC
## get_recent_roadmaps

### Description
Retrieves Microsoft 365 roadmap posts from Microsoft Release Communications. Returns up to 50 roadmap items per request with truncated descriptions. Supports OData filtering by products, platforms, release rings, cloud instances, status, availability dates, and publication dates, as well as text search on titles and pagination.
```

--------------------------------

### Check Group Mailbox Size

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/create-groups/group-mailbox-size-management

Retrieve the current size statistics for a group mailbox to monitor storage consumption.

```PowerShell
Get-MailboxStatistics <groupname> | ft TotalDeletedItemSize,TotalItemSize 
```

```PowerShell
Get-MailboxStatistics <groupname> |ft TotalItemSize,TotalDeletedItemSize 
```

--------------------------------

### Enable sending from email aliases

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/email/add-another-email-alias-for-a-user

Use this PowerShell cmdlet to allow users in your organization to select their email aliases in the From dropdown when composing messages in Outlook on the web.

```powershell
Set-OrganizationConfig -SendFromAliasEnabled $true
```

--------------------------------

### Finalize script execution

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/resolve-site-urls

Prompts the user to exit the script.

```PowerShell
Write-Host
Read-Host "Press any key to exit..."
```

--------------------------------

### Update Group Mail Nickname

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365bp-devices-groups-categories

Set the MailNickname property to MdeDeviceConfiguration to enable the group for use in Defender portal policies.

```PowerShell
Update-MgGroup -GroupId $ID -MailNickname MdeDeviceConfiguration
```

--------------------------------

### Remove a user from priority accounts with PowerShell

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/priority-accounts

Removes a user from the priority accounts list by setting the VIP flag to false.

```PowerShell
Set-User -VIP $false -Identity <Identity> -Confirm:$false
```

--------------------------------

### Set-DeviceConditionalAccessRule

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Modifies an existing device conditional access rule.

```APIDOC
## Set-DeviceConditionalAccessRule

### Description
Modifies an existing device conditional access rule (Block access).

### Parameters
- **Identity** (string) - Required - The name of the rule to modify.
- **TargetGroups** (string[]) - Required - A list of Security Group GUIDs to target. This parameter overwrites existing values.
- **AllowJailBroken** (boolean) - Optional - Specifies whether to allow jailbroken devices.
```

--------------------------------

### Remove-DeviceConfigurationPolicy

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-devices-basic-mobility-security-policies-configure

Removes a device configuration policy.

```APIDOC
## Remove-DeviceConfigurationPolicy

### Description
Removes a device configuration policy (Allow access). The associated device rule is also marked for deletion.

### Parameters
- **Identity** (string) - Required - The name of the policy to remove.
```

--------------------------------

### Evaluate with a specific scoring engine

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-tools-for-agent

Forces the use of a specific coding agent for semantic evaluation.

```PowerShell
a365 develop-mcp evaluate --server-url "http://localhost:5000/mcp" --eval-engine claude-code
```

--------------------------------

### Disable Strong Password Requirements for All Users

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/resend-user-password

Iterates through all users and updates their password policies to disable strong password requirements.

```PowerShell
Get-MgUser | ForEach-Object { Update-MgUser -UserId $_.Id -PasswordPolicies "DisableStrongPassword" }
```

--------------------------------

### Check Group Mailbox Quotas

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/create-groups/group-mailbox-size-management

Retrieve the current quota limits assigned to a specific group mailbox.

```PowerShell
Get-Mailbox -GroupMailbox <groupname> |ft ProhibitSendReceiveQuota,ProhibitSendQuota,IssueWarningQuota 
```

--------------------------------

### get_roadmap_by_id

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/mrc-mcp

Retrieves a specific Microsoft 365 roadmap post by its unique identifier.

```APIDOC
## get_roadmap_by_id

### Description
Retrieves a specific Microsoft 365 roadmap post by its unique identifier. Returns full details of products and availability dates.
```

--------------------------------

### Retrieve Group ID

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365bp-devices-groups-categories

Fetch the unique identifier for a specific device group by its display name.

```PowerShell
$ID = (Get-MgGroup -Filter "DisplayName eq '<DisplayName>'").Id
```

```PowerShell
$ID = (Get-MgGroup -Filter "DisplayName eq 'Engineering Dynamic Device Group'").Id
```

--------------------------------

### Get-MgGroupPhoto

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/change-user-profile-photos

Retrieves metadata information about a group's profile photo.

```APIDOC
## Get-MgGroupPhoto

### Description
Returns metadata (Id, Height, Width) for the group's existing photo.

### Syntax
`Get-MgGroupPhoto -GroupId <ID>`

### Example
`Get-MgGroupPhoto -GroupId 173cd812-5563-439c-9da4-bc2715fa2aee`
```

--------------------------------

### Remove User or Group Photos via PowerShell

Source: https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/change-user-profile-photos

Deletes the profile photo for the specified user or group.

```PowerShell
Remove-MgUserPhoto -UserId <UPN>
```

```PowerShell
Remove-MgUserPhoto -UserId albertas@contoso.onmicrosoft.com
```

```PowerShell
Remove-MgGroupPhoto -GroupId <ID>
```

```PowerShell
Remove-MgGroupPhoto -GroupId 173cd812-5563-439c-9da4-bc2715fa2aee
```