Cookies on ScriptPreflight

We use strictly necessary storage to sign you in, take payments and keep the site secure. With your permission we also count visits, without cookies, to see which pages help. We don't run marketing tags. Cookie policy

Use case · Microsoft 365

Change one user, not the whole tenant.

Graph, Entra ID, Exchange Online, Teams, SharePoint and Intune scripts, with the scopes they really need.

Run a free preflightSee a sample report

No card required. Your script is never executed.

Three patterns we flag

  • Loops over every user in the tenant

    Get-MgUser -All | ForEach-Object { Update-MgUser -UserId $_.Id -AccountEnabled:$false }

  • Asks for far more access than the job needs

    Connect-MgGraph -Scopes "Directory.ReadWrite.All"

  • Grants full access to every mailbox

    Get-Mailbox -ResultSize Unlimited | Add-MailboxPermission -User helpdesk -AccessRights FullAccess

Sample: offboard-user.ps1

Real pattern, synthetic script. Unfiltered tenant-wide target.

Try this sample in the free checker

What we check

  • Unbounded -All and -ResultSize Unlimited queries
  • Graph permission scopes (preview)
  • Licence, sign-in and session changes
  • Mailbox delegation and forwarding

What we can't know

  • · How many objects match in your environment when it runs
  • · The current state of your environment
  • · Which permissions the account running it actually holds

The script is never run and we never connect to your environment, so every report states what it could not determine.

Check the next script before it runs.

Run a free preflightSee a sample report