Arviteni Contact us

Practical resources for Microsoft 365

Free PowerShell scripts and step-by-step guides to help IT teams review access, manage licences and handle user offboarding. The first beta versions are ready to download and test.

Browse the resources See a guided example

Choose the task you need to complete

Choose a task and follow the prompts using your Microsoft 365 administrator account. Reports let you review the scope, see a summary and save CSVs with one audit log before checking another user or scope. Each ZIP includes a short guide and an MIT licence. Windows PowerShell 5.1 is supported; no tenant ID is needed. These are beta scripts: test them in a non-production tenant first.

User offboarding

Leavers · Guided workflow

Review a departing employee’s account, block access and preserve their mailbox through a guided process.

Starting point
The employee’s sign-in email address
Output
One audit log in an outcome folder

What the script does

  1. Enter the employee’s email, choose the actions and sign in to Microsoft 365.
  2. Review the current settings and what will change, then confirm once to proceed.
  3. See each result in the console, with existing settings skipped and one audit log saved.

Scope and considerations

For cloud-only member users. Add -WhatIf for a read-only check. Account deletion, licence removal and OneDrive retention remain separate decisions.

Microsoft’s offboarding guidance 
Download ZIP

v0.1.3-beta · ZIP with guide

SHA-256 checksum

Licence assignments and usage

Licences · Report

Bring licence assignments and recorded activity together to identify accounts that need a closer review.

Starting point
Everyone, or a department to review
Output
Two licence CSVs and one audit log

What the script does

  1. Choose a department and activity period, then review the report scope.
  2. Read licence assignments, tenant seat inventory and available activity data.
  3. See a summary and save both CSVs with one audit log. Missing or ambiguous activity is labelled.

Scope and considerations

A read-only report; no licences are removed. Low or missing activity does not establish that a licence is unnecessary.

Download ZIP

v0.2.0-beta · ZIP with guide

SHA-256 checksum

Shared mailbox permissions

Email & access · Report

Review who can open a shared mailbox, send as it or send on its behalf.

Starting point
A shared mailbox address
Output
A permissions CSV and audit log

What the script does

  1. Enter the shared mailbox email and confirm the report scope.
  2. Read Full Access, Send As and Send on Behalf assignments.
  3. Save the permissions CSV and audit, with failed reads labelled alongside the results.

Scope and considerations

Permissions are not changed. Group assignments are identified where possible, but group members are not expanded.

Download ZIP

v0.2.0-beta · ZIP with guide

SHA-256 checksum

MFA registration

Security · Report

Review registered authentication methods and identify users who have not completed MFA registration.

Starting point
All users, or a group to check
Output
A registration CSV and audit log

What the script does

  1. Choose all visible users or enter a group ID, then review the scope.
  2. Read authentication registration details using your approved reporting access.
  3. Review the summary and save a CSV and audit. Unknown and unsupported accounts stay clearly labelled.

Scope and considerations

Registration is separate from MFA enforcement at sign-in. This report does not change authentication methods or policies. Missing and disabled-user records are labelled separately.

Microsoft’s authentication reports guidance 
Download ZIP

v0.2.0-beta · ZIP with guide

SHA-256 checksum

External email forwarding

Security · Report

Identify mailbox forwarding and inbox rules that send messages outside your organisation.

Starting point
One mailbox, or the whole organisation
Output
A forwarding CSV with coverage and an audit log

What the script does

  1. Choose one mailbox or all visible user and shared mailboxes.
  2. Review the scope, then read mailbox forwarding and inbox-rule destinations.
  3. Save the CSV and audit. Coverage, failed reads and ignored forwarding settings appear with the findings.

Scope and considerations

The report does not disable rules. Failed reads and unresolved destinations stay visible. External forwarding needs review; it does not by itself prove an account is compromised.

Download ZIP

v0.2.0-beta · ZIP with guide

SHA-256 checksum

Inactive user accounts

Leavers · Report

Review accounts with older successful sign-in dates, with missing activity data shown separately.

Starting point
A period, such as 60 or 90 days
Output
An activity CSV and audit log

What the script does

  1. Choose a period, such as 60 or 90 days, and review the scope.
  2. Read successful sign-in dates and count recent, older and unknown activity.
  3. Save the activity CSV and audit so account owners can review whether access is still needed.

Scope and considerations

Accounts are not disabled. Missing sign-in data is reported as unknown. Accessing the sign-in property through Microsoft Graph requires Entra ID P1 or P2.

Microsoft’s inactive account guidance 
Download ZIP

v0.2.0-beta · ZIP with guide

SHA-256 checksum

Mailbox storage and quotas

Email & access · Report

Compare mailbox sizes with their configured quotas and identify accounts approaching capacity.

Starting point
A mailbox scope and usage threshold
Output
A storage CSV and audit log

What the script does

  1. Choose one mailbox or all visible mailboxes, then set a usage threshold.
  2. Review the scope and read primary and archive sizes against their quotas.
  3. Save the results in usage order with an audit. Unknown sizes and failed reads remain visible.

Scope and considerations

The report does not change mailbox settings. Unknown sizes and failed reads are labelled; auto-expanding archives need a separate review.

Download ZIP

v0.2.0-beta · ZIP with guide

SHA-256 checksum

Compare user group memberships

Email & access · Report

See shared memberships and differences between two users when investigating an access problem.

Starting point
Two sign-in email addresses
Output
A comparison CSV and audit log

What the script does

  1. Enter two different user email addresses and review the comparison scope.
  2. Compare visible group memberships by ID, including nested groups.
  3. Save the comparison CSV and audit, then choose whether to check another pair of users.

Scope and considerations

Group membership is only part of a user’s access. The report compares Graph-visible transitive groups by ID. Hidden memberships and dynamic distribution groups are outside its scope; permissions are never copied.

Download ZIP

v0.2.0-beta · ZIP with guide

SHA-256 checksum

Is there another task you would find useful?

Suggest a resource 

* Always read and understand scripts before running them, especially those downloaded from unfamiliar internet sources. These resources are provided “as is”, without warranty. You are responsible for their use. To the fullest extent permitted by law, Arviteni Ltd accepts no liability for loss, damage or service interruption arising from their use or modification. Nothing excludes liability that cannot lawfully be excluded.

Choose the actions, review what will change and confirm once. This example uses a fictional account; the script checks the current settings and saves one audit log.

PowerShell Offboard-User.ps1Illustrative preview
PS C:\Scripts> .\Offboard-User.ps1
Microsoft 365 offboarding
Choose actions, review their effect, then confirm once.

Which user is leaving?
UPN: alex@example.co.uk

What would you like to do?
[1] Block sign-in
[2] Revoke sign-in sessions
[3] Convert to shared mailbox
[4] Grant a colleague Full Access (no Send As)
Choose actions (comma-separated): 1,2,3
# Microsoft sign-in and tenant checks omitted from this example.

Review: Alex Morgan <alex@example.co.uk>
The options you have selected will do the following:
Sign-in allowed → Block new sign-ins
Sessions → Request revocation (tokens may take time to expire)
User mailbox → Convert to shared, keeping its contents
Account deletion and licence removal: excluded.
Would you like to proceed? [y/N]: y

[Verified] Sign-in blocked
[Requested] Session revocation accepted by Microsoft
[Verified] Shared mailbox
[Saved] audit.json in Outcomes\offboarding-<timestamp>-<id>

Example complete. Account and licences retained.
Settings checked. Session revocation can take time. Review retention separately.

Would you like to action another user? [y/N]: n
Offboarding session finished. You can close this window.

PS C:\Scripts>

Example session · No tenant connected

Review your Microsoft 365 environment

For a wider review, our Microsoft 365 audit covers licences, identity, access and configuration, with findings and priorities your team can act on.

Explore a Microsoft 365 audit