This module will install a new AD forest and domain controller. It will securely pull down organization secrets from Azure and use them to configure the domain controller.It also remove the secrets from the local machine after the domain controller opoeration has been completed.

Automates the full lifecycle of Windows Server Storage Spaces resources — pool, virtual disk, GPT volume, NTFS label, and workload-specific artifacts — in a single command. Supports Active Directory, SQL Server, SCCM, and WSUS workloads with idempotent create/remove, WhatIf/Confirm safety, and structured logging.

Automates Active Directory Domain Services (AD DS) deployment on Windows Server. Provides Invoke-ADDSForest to create a new forest and Invoke-ADDomainController to promote additional domain controllers. Supports direct passwords, Azure Key Vault, and SecretManagement vaults for DSRM password retrieval.

Runs read-only Microsoft Entra ID and Intune Zero Trust assessments using Microsoft Graph collection, declarative checks, maturity scoring, and local report artifact generation for consultant-led delivery.

Admin-run, one-time provisioning commands (certificate, Entra ID app registration, Exchange Online role grants) for the read-only Get-EntraZTAssess assessment toolkit. Published separately from the assessment module because it performs Graph and Exchange Online WRITE operations, which the read-only assessment surface never does.

Audit reporting for Microsoft Entra ID Conditional Access exclusions. Enumerates every Conditional Access policy in a tenant and exports one CSV row per excluded user or group principal per policy, so that every deliberate hole in a Conditional Access control is visible and attributable. Excluded directory roles and excluded guest/external user typ... More info

Read-only Microsoft Entra ID unmanaged and stale device reporting via Microsoft Graph. Generates CSV evidence for device-exposure assessment findings; performs no writes to any tenant.

Read-only Microsoft Entra ID multifactor authentication registration reporting via Microsoft Graph. Generates CSV evidence identifying users without MFA registered, for MFA-coverage assessment findings; performs no writes to any tenant.

Assesses, reports on, remediates and rolls back over-permissive explicit Everyone/GenericAll ACEs on Active Directory Organizational Units.

Read-only Conditional Access policy inventory and unique-values catalogue module, built on the Microsoft Graph PowerShell SDK. Retrieves every Conditional Access policy in a tenant, normalises each into a flat per-policy record, and aggregates a deduplicated catalogue of the distinct values in use (workloads, grant controls, platforms, locations, c... More info

Cross-organization PowerShell toolkit for constructing, deploying and validating DMARC, DKIM and SPF email-authentication records against Microsoft 365 tenants, with a pluggable DNS-provider abstraction and full evidence-pack output for change control.