EntraHygiene
1.0.0
Read-only Microsoft 365 / Entra ID identity hygiene checks. Finds stale accounts, privileged accounts without strong MFA, permanent vs eligible role assignments, conditional-access gaps, and licenses on inactive accounts. Outputs objects, not text.
Minimum PowerShell version
7.2
Installation Options
Owners
Copyright
(c) 2026 Eduard Arbona. Released under the MIT licence.
Package Details
Author(s)
- Eduard Arbona
Tags
Entra EntraID AzureAD Microsoft365 MicrosoftGraph Security Identity Graph Audit ReadOnly MFA PIM ConditionalAccess BlueTeam
Functions
Get-EhStaleAccount Get-EhPrivilegedWithoutMfa Get-EhRoleAssignment Get-EhConditionalAccessGap Get-EhInactiveLicense
PSEditions
Dependencies
-
- Microsoft.Graph.Authentication (>= 2.0.0)
Release Notes
1.0.0 - First release on the PowerShell Gallery. Five read-only identity-hygiene checks over Microsoft Graph: stale accounts, privileged accounts without a strong authentication method, permanent versus eligible (PIM) role assignments, Conditional Access gaps, and licenses sitting on inactive accounts. Every cmdlet returns objects rather than formatted text. There is no write path in the module and a Pester test fails the build if a Graph write verb appears anywhere in it. Authentication is the caller's existing Connect-MgGraph session; the module never handles credentials. Full history: https://github.com/earbona23/EntraHygiene/blob/main/CHANGELOG.md
FileList
- EntraHygiene.nuspec
- EntraHygiene.psd1
- EntraHygiene.psm1
- Private\Invoke-EhGraph.ps1
- Public\Get-EhConditionalAccessGap.ps1
- Public\Get-EhInactiveLicense.ps1
- Public\Get-EhPrivilegedWithoutMfa.ps1
- Public\Get-EhRoleAssignment.ps1
- Public\Get-EhStaleAccount.ps1
Version History
| Version | Downloads | Last updated |
|---|---|---|
| 1.0.0 (current version) | 8 | 11/5/2026 |