M365 PowerShell Modules — What to Install in 2026
Visual reference of the modern PowerShell modules every M365 admin needs — Microsoft.Graph, ExchangeOnlineManagement, MicrosoftTeams, PnP.PowerShell. Plus what's deprecated and migrate-off.
If you still use AzureAD or MSOnline you're working blind. Microsoft.Graph is the present. Here's the modern stack for M365 admin scripting.
Last reviewed
Frequently Asked Questions
Why migrate off AzureAD and MSOnline modules?
MSOnline reached end-of-support on **May 30, 2025**. The legacy AzureAD module was retired on **August 31, 2025** — it no longer works in production. Both used legacy Azure AD Graph endpoints that Microsoft has deprecated. The replacement is the Microsoft.Graph PowerShell module which uses Microsoft Graph API. If you have scripts referencing Get-MsolUser, Get-AzureADUser, Connect-MsolService — they're already broken. Microsoft also released the new **Microsoft.Entra** module in 2025 which provides a cmdlet experience closer to the old AzureAD module while using Graph under the hood.
Why is Microsoft.Graph split into so many sub-modules?
The full Microsoft.Graph module is huge (gigabytes). To save load time and disk, Microsoft splits it into per-resource sub-modules: Microsoft.Graph.Users, Microsoft.Graph.Groups, Microsoft.Graph.Identity.SignIns, Microsoft.Graph.DeviceManagement, etc. You install only the sub-modules your scripts use. The 'Microsoft.Graph' meta-module pulls in everything (handy for ad-hoc PowerShell sessions, painful for production runners).
What's PnP.PowerShell and when do I need it?
PnP (Patterns and Practices) is a community-driven module focused on SharePoint at scale — site provisioning, template extraction, permission reporting, content migration. Microsoft.Graph can do basic SharePoint operations, but PnP.PowerShell goes deeper: bulk site operations, custom field updates, complex permission audits. Most enterprise SharePoint admins use it for any non-trivial automation. Note: as of 2024 PnP requires app-only authentication (no more user creds) due to security tightening.
How should I authenticate in 2026?
App-only (service principal with certificate or federated identity) for production automation. Interactive (Connect-MgGraph) for ad-hoc admin work. Avoid passwords / client secrets where possible — they get committed to source control by accident. Workload Identity Federation (no secrets) is the gold standard for CI/CD running PowerShell against tenants. For human admins, MFA-protected interactive sign-in via Connect-MgGraph -Scopes is the day-to-day pattern.