msec

0.2.0

Read Microsoft security posture - Secure Score, Defender XDR, Entra ID (directory roles, Conditional Access, MFA, licensing), Intune, Exchange Online, SharePoint Online, Azure and Azure DevOps - as flat PowerShell objects you can filter, group and export. Read-only by design: every Get-Msec* command reads, and the only command that writes is New-MsecApp, which creates
Read Microsoft security posture - Secure Score, Defender XDR, Entra ID (directory roles, Conditional Access, MFA, licensing), Intune, Exchange Online, SharePoint Online, Azure and Azure DevOps - as flat PowerShell objects you can filter, group and export. Read-only by design: every Get-Msec* command reads, and the only command that writes is New-MsecApp, which creates its own app registration and grants it read permissions - and, when asked with -Workload Exchange, assigns it a directory role, which Exchange requires and which is a tenant-wide privilege grant rather than an API permission. Authentication is certificate-based via that app registration, and the private key never leaves Azure Key Vault - signing happens there, so no key material reaches the machine running the module.
Show more

Minimum PowerShell version

7.0

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name msec -RequiredVersion 0.2.0

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name msec -Version 0.2.0

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

(c) 2026 Anton Lindström. Licensed under the MIT License.

Package Details

Author(s)

  • Anton Lindstrom

Tags

MicrosoftSecurity Security SecureScore Defender DefenderXDR ExposureManagement Entra EntraID AzureAD ConditionalAccess MFA PIM PrivilegedAccess Intune MDM Compliance Azure ExchangeOnline SharePointOnline Microsoft365 KeyVault Graph Audit Posture CrossPlatform Windows Linux macOS

Functions

New-MsecApp Connect-Msec Disconnect-Msec Connect-MsecGraphSdk Connect-MsecExchangeOnline Connect-MsecSharePointOnline Get-MsecSecureScore Get-MsecAzureCost Get-MsecAzureSecureScore Get-MsecDefenderScoreExposure Get-MsecDefenderScoreDeviceConfiguration Get-MsecDefenderDevice Get-MsecDefenderEmailStats Get-MsecDefenderIncidentStats Get-MsecKeyVaultCertificate Get-MsecIntuneConfigurationProfile Get-MsecIntuneCompliancePolicy Get-MsecIntuneDevice Get-MsecIntuneScriptResult Get-MsecEntraConditionalAccessPolicy Get-MsecEntraConditionalAccessSignInLog Get-MsecEntraConditionalAccessStats Get-MsecEntraTenantSecuritySetting Get-MsecExchangeMailboxPermission Get-MsecSharePointSite Get-MsecSharePointSiteUser Get-MsecEntraGroupMember Get-MsecEntraLicense Get-MsecEntraRoleHolder Get-MsecEntraAppCredential Get-MsecEntraMfaRegistration Get-MsecEntraMfaEvidence Get-MsecEntraMfaRegistrationStats Get-MsecEntraDisabledUser Convert-MsecEntraSid Search-MsecAzureResourceGraph Search-MsecLogAnalytics Invoke-MsecAzureVMScript Select-MsecAzureContext Get-MsecAdoServiceConnection Export-MsecPostureReport Export-MsecVMUpdateReport Export-MsecVMNtpReport Export-MsecEntraDisabledUserReport Export-MsecDefenderDeviceReport Export-MsecEntraGroupMemberReport

Dependencies

Release Notes

v0.2.0
- Exchange Online and SharePoint Online: mailbox permissions, site inventory, and site
 owners/members with security groups expanded to the people inside them.
- Bridges that let the Microsoft.Graph SDK, ExchangeOnlineManagement and PnP.PowerShell
 run as the msec app without the certificate's private key reaching the machine.
- Azure: unused resources, network exposure across twelve resource types, Key Vault
 certificate expiry, Cost Management, App Service inventory and stack settings.
- Entra: group members (nested groups expanded, PIM-eligible included), app registration
 and service principal credential expiry.
- Defender: device inventory with per-device vulnerability counts.
- Evidence reports for Defender devices and Entra group membership; the posture report
 gained privileged access, device platform and OS release measurements.
- New-MsecApp -Workload Exchange, SharePoint grants those workloads' permissions. Exchange
 additionally needs a DIRECTORY ROLE - an app role alone is not enough, and without one
 every Exchange call fails with an authorisation error that names nothing.

v0.1.0
- First release. Read-only Microsoft security posture as flat objects: Secure Score,
 Defender XDR, Entra ID (roles, Conditional Access, MFA, licensing), Intune and Azure.
- Certificate-based auth against an app registration; the private key stays in Azure
 Key Vault and signing happens there.

See CHANGELOG.md for full version history.

FileList

Version History

Version Downloads Last updated
0.3.0 18 9/9/2026
0.2.0 (current version) 6 9/7/2026
0.1.1 16 8/20/2026
0.1.0 3 8/20/2026