msec

0.3.0

Read Microsoft security posture - Secure Score, Defender XDR, Entra ID (directory roles, Conditional Access, MFA, licensing), Intune, Exchange Online, SharePoint Online, Microsoft Teams, Azure and Azure DevOps - as flat PowerShell objects you can filter, group and export. Read-only by design: every Get-Msec* command reads, and the only command that writes is New-MsecA
Read Microsoft security posture - Secure Score, Defender XDR, Entra ID (directory roles, Conditional Access, MFA, licensing), Intune, Exchange Online, SharePoint Online, Microsoft Teams, Azure and Azure DevOps - as flat PowerShell objects you can filter, group and export. Read-only by design: every Get-Msec* command reads, and the only command that writes is New-MsecApp, which creates its own app registration and grants it read permissions - and, when asked with -Workload Exchange or Teams, assigns it a directory role, which those services require and which is a tenant-wide privilege grant rather than an API permission. Authentication is certificate-based via that app registration, and the private key never leaves Azure Key Vault - signing happens there, so no key material reaches the machine running the module.
Show more

Minimum PowerShell version

7.0

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name msec

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name msec

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

(c) 2026 Anton Lindström. Licensed under the MIT License.

Package Details

Author(s)

  • Anton Lindstrom

Tags

MicrosoftSecurity Security SecureScore Defender DefenderXDR ExposureManagement Entra EntraID AzureAD ConditionalAccess MFA PIM PrivilegedAccess Intune MDM Compliance Azure ExchangeOnline SharePointOnline MicrosoftTeams Teams Microsoft365 KeyVault Graph Audit Posture CrossPlatform Windows Linux macOS

Functions

New-MsecApp Connect-Msec Disconnect-Msec Connect-MsecGraphSdk Connect-MsecExchangeOnline Connect-MsecSharePointOnline Connect-MsecTeams Get-MsecSecureScore Get-MsecAzureCost Get-MsecAzureRoleAssignment Get-MsecAzureSecureScore Get-MsecDefenderScoreExposure Get-MsecDefenderScoreDeviceConfiguration Get-MsecDefenderDevice Get-MsecDefenderEmailStats Get-MsecDefenderIncidentStats Get-MsecKeyVaultCertificate Get-MsecIntuneConfigurationProfile Get-MsecIntuneCompliancePolicy Get-MsecIntuneDevice Get-MsecIntuneScriptResult Get-MsecEntraConditionalAccessPolicy Get-MsecEntraConditionalAccessSignInLog Get-MsecEntraConditionalAccessStats Get-MsecEntraTenantSecuritySetting Get-MsecExchangeMailboxPermission Get-MsecSharePointSite Get-MsecTeamsPolicy Get-MsecSharePointSiteUser Get-MsecSharePointTenantSetting Get-MsecEntraGroupMember Get-MsecEntraLicense Get-MsecEntraRoleHolder Get-MsecEntraAppCredential Get-MsecEntraMfaRegistration Get-MsecEntraMfaEvidence Get-MsecEntraMfaRegistrationStats Get-MsecEntraDisabledUser Convert-MsecEntraSid Search-MsecAzureResourceGraph Search-MsecLogAnalytics Invoke-MsecAzureVMScript Select-MsecAzureContext Get-MsecAzureDevOpsServiceConnection Get-MsecAzureDevOpsOrganizationPolicy Get-MsecAzureDevOpsUser Export-MsecPostureReport Export-MsecVMUpdateReport Export-MsecVMNtpReport Export-MsecEntraDisabledUserReport Export-MsecDefenderDeviceReport Export-MsecEntraGroupMemberReport

Dependencies

Release Notes

v0.3.0
- Microsoft Teams: Connect-MsecTeams and Get-MsecTeamsPolicy - external access and federation,
 guest access, meeting lobby and anonymous join, recording, app installation, and file sharing
 in chats with external users. One row per SETTING, so policies diff between tenants.
- SharePoint: Get-MsecSharePointTenantSetting reads the tenant-wide sharing posture that no
 per-site review can show - sharing capability, domain allow/block lists, legacy auth.
- Azure DevOps: Get-MsecAzureDevOpsUser (users and their group memberships, paginated) and
 Get-MsecAzureDevOpsOrganizationPolicy (guest access, third-party OAuth, SSH, public projects).
- Connect-MsecTeams -AsCurrentUser borrows the Azure session, because the Teams module cannot
 sign in interactively off Windows and Conditional Access refuses device code flow.
- New-MsecApp: -Workload Teams, and -ExchangeDirectoryRole is now -DirectoryRole (the old name
 still works). -Workload SharePoint also grants SharePointTenantSettings.Read.All.
- Azure RBAC: Get-MsecAzureRoleAssignment across every subscription, with role and principal
 names resolved and deleted principals kept rather than dropped.
- FIXED ON LINUX: the module folder and manifest are lowercase, matching the Gallery id. Before
 this, Install-Module created msec/<version>/Msec.psd1 and Import-Module failed on Linux with
 "no valid module file was found in any module directory" - a module that installed fine and
 could not be loaded. macOS and Windows were unaffected.
- The Azure DevOps commands are now named Get-MsecAzureDevOps* rather than Get-MsecAdo*.
 Get-MsecAdoServiceConnection from 0.2.0 is renamed; there is no alias.

v0.2.0
- Exchange Online and SharePoint Online: mailbox permissions, site inventory, and site
 owners/members with security groups expanded to the people inside them.
- Bridges that let the Microsoft.Graph SDK, ExchangeOnlineManagement and PnP.PowerShell
 run as the msec app without the certificate's private key reaching the machine.
- Azure: unused resources, network exposure across twelve resource types, Key Vault
 certificate expiry, Cost Management, App Service inventory and stack settings.
- Entra: group members (nested groups expanded, PIM-eligible included), app registration
 and service principal credential expiry.
- Defender: device inventory with per-device vulnerability counts.
- Evidence reports for Defender devices and Entra group membership; the posture report
 gained privileged access, device platform and OS release measurements.
- New-MsecApp -Workload Exchange, SharePoint grants those workloads' permissions. Exchange
 additionally needs a DIRECTORY ROLE - an app role alone is not enough, and without one
 every Exchange call fails with an authorisation error that names nothing.

v0.1.0
- First release. Read-only Microsoft security posture as flat objects: Secure Score,
 Defender XDR, Entra ID (roles, Conditional Access, MFA, licensing), Intune and Azure.
- Certificate-based auth against an app registration; the private key stays in Azure
 Key Vault and signing happens there.

See CHANGELOG.md for full version history.

FileList

Version History

Version Downloads Last updated
0.3.0 (current version) 18 9/9/2026
0.2.0 6 9/7/2026
0.1.1 16 8/20/2026
0.1.0 3 8/20/2026