top of page
Writer's pictureThe Tech Platform

Migrating from Get-MsolUser to Get-AzureADUser: A Developer's Guide

The Azure Active Directory (Azure AD) user management is constantly evolving. As Microsoft prioritizes newer technologies, developers must keep their scripts up-to-date.

Why Migrate?

While Get-MsolUser might still function, it's deprecated, meaning future Azure AD updates might break its functionality or limit its effectiveness. Get-AzureADUser, on the other hand, is actively supported by Microsoft, ensuring compatibility and access to the latest features.


What You'll Learn:

This guide empowers you to navigate the world of Azure Active Directory (Azure AD) user management with PowerShell. It delves into two key cmdlets: Get-MsolUser and Get-AzureADUser. We'll explore their functionalities, identify the key differences, and guide you to the transition from the Get-MsolUser to the modern Get-AzureADUser.


PowerShell Cmdlets for Azure AD:

Before diving into the migration, let's establish a basic understanding of cmdlets. Cmdlets are mini-programs within PowerShell designed for specific tasks. In the context of Azure AD, these cmdlets allow you to interact with user data, groups, and other objects within your Azure AD tenant.

Migrating from Get-MsolUser to Get-AzureADUser: A Developer's Guide

Understanding Get-MsolUser

Get-MsolUser is your go-to cmdlet for retrieving information about users in your Azure Active Directory (Azure AD) tenant. This powerful tool has granular control over user data, streamlining various user management tasks. 


Function 

Get-MsolUser acts like a searchlight within Azure AD, allowing you to pinpoint specific users or retrieve a list of users based on your criteria.


Targeting Users 

You can target individual users by specifying their unique identifiers:

  • UserPrincipalName (UPN): This is typically the user's email address (e.g., john.doe@contoso.com).

  • ObjectID: A globally unique identifier assigned to each user in Azure AD.


Data Retrieval

Once you identify the target user(s), Get-MsolUser retrieves a wealth of information, including:

  • Display Name (user's full name)

  • UPN

  • License Assignment (whether the user has an Office 365 license)

  • Department

  • Account Enabled Status (active or disabled)

  • And many more attributes depending on your Azure AD configuration

Common Use Cases:

Get-MsolUser serves as a versatile tool for various user management tasks:

  • User Information Verification: Before making changes to user accounts (e.g., license assignment, group membership), you can use Get-MsolUser to confirm existing details and avoid potential errors.

  • Identifying Specific Users: Need to find users with a particular license type or belonging to a specific department? Get-MsolUser allows you to filter users based on these attributes, saving you valuable time.

  • Reporting and Auditing:  Get-MsolUser can be integrated into scripts to generate reports on user activity, license usage, or identify inactive accounts. This data is crucial for optimizing resource allocation and security measures.

  • Automation Powerhouse: Scripting with Get-MsolUser unlocks automation potential. You can automate tasks like:

  • User provisioning (adding new users to the system)

  • Bulk license assignment

  • User data extraction for reporting purposes


Example Code in Action (Scenario: Finding Users Without Licenses):

Here's how to use Get-MsolUser to identify users who haven't been assigned any licenses:

# 1. Retrieve information for all users:
$allUsers = Get-MsolUser

# 2. Filter users based on license status:
$ unlicensedUsers = $allUsers | Where-Object { $_.isLicensed -eq $false }

# 3. Display the UPN of unlicensed users:
$unlicensedUsers | ForEach-Object { Write-Host $_.UserPrincipalName }

In this example, the script first retrieves information for all users using Get-MsolUser. Then, it uses the Where-Object cmdlet to filter the retrieved data, keeping only users where the isLicensed property is $false (indicating no license assignment). Finally, it iterates through the filtered list and displays the unlicensed user's UPN (email address).


Limitations to Consider:

While Get-MsolUser is a powerful tool, it's essential to be aware of its limitations:

  • Default Result Limit: By default, it only retrieves the first 500 users in your Azure AD tenant. For larger organizations, use the -All parameter to retrieve all users or -MaxResults to set a custom limit.

  • Advanced User Management: Get-MsolUser excels at retrieving information, but for tasks like creating new users or modifying existing user details, consider using New-MsolUser or Set-MsolUser cmdlets.

  • Deprecated Module: While still functional, Microsoft recommends using the Get-AzureADUser cmdlet in newer scripts for future compatibility.


Remember, for advanced user management tasks, explore the functionalities of New-MsolUser and Set-MsolUser cmdlets, and consider using Get-AzureADUser in new development projects.


Understanding Get-AzureADUser

Get-AzureADUser is an essential cmdlet in the Azure AD PowerShell module.  It is a powerful tool for retrieving information about users within your Azure Active Directory (Azure AD) tenant. Here's a breakdown of its functionalities, common use cases, and the advantages it offers:

Explanation:

  • Function: Get-AzureADUser bridges the gap between your PowerShell session and Azure AD. It allows you to:

  • Target Specific Users:  Pinpoint individual users by specifying their UserPrincipalName (UPN) (e.g., john.doe@contoso.com) or ObjectID to access detailed information.

  • List Users: Retrieve a list of users based on your criteria. By default, it displays the first 500 users, but you can adjust this with -All or -MaxResults parameters.


Common Use Cases:

Retrieving User Information: You can use Get-AzureADUser to retrieve information about a specific user or all users in your Azure AD. For example, to get information about a specific user:

Get-AzureADUser -ObjectId john.doe@domain.com

Filtering Users: Get-AzureADUser supports OData query parameters, which you can use to filter users based on certain criteria. For example, to find all users in your Azure AD whose display name starts with “John”:

Get-AzureADUser -Filter "startswith(DisplayName,'John')"

Checking User Licenses: You can use Get-AzureADUser in combination with other cmdlets to check the licenses assigned to a user. For example:

(Get-AzureADUser -ObjectId john.doe@domain.com | Get-AzureADUserLicenseDetail).ServicePlans

Auditing User Activities: Get-AzureADUser can be used in scripts to audit user activities, such as sign-in logs, changes to user properties, etc.


Advantages of Get-AzureADUser:

  • Future-Proof Technology: As a continuously supported cmdlet, Get-AzureADUser ensures compatibility with future Azure AD updates and functionalities, making it a reliable choice for long-term use.

  • Enhanced Filtering Capabilities: Compared to its predecessor, Get-MsolUser, Get-AzureADUser offers more advanced filtering options. You can perform granular searches based on various user attributes, allowing for greater precision in identifying specific users.

  • Potential Performance Boost: In some scenarios, Get-AzureADUser may provide improved performance when retrieving large sets of user data, making it a more efficient choice for handling significant amounts of user information.

  • Security-Focused: Get-AzureADUser integrates seamlessly with Azure AD security features. You can leverage this feature to filter users based on security group membership or risk level, enhancing your security posture.


Comparison of Get-MsolUser and Get-AzureADUser

Here are some similarities between Get-MsolUser and Get-AzureADUser

  • Scripting: Both cmdlets can be used within scripts for automation tasks.

  • User Management: While both retrieve information, for tasks like creating or modifying users, use New-MsolUser or Set-MsolUser (deprecated) or New-AzureADUser and Set-AzureADUser respectively.


The Differences between Get-MsolUser and Get-AzureADUser

Factors

Get-MsolUser

Get-AzureADUser

Module

Microsoft Azure AD PowerShell (MSOnline)

Microsoft Azure AD PowerShell

Support Status

Still functional, but deprecated

Actively supported

Future Compatibility

Limited, may not work with future updates

Ensured compatibility with future updates

API Used

Older Azure AD Management API

Microsoft Graph API (prefered)

Data Retrieval

Similar core attributes, some may differ

More comprehensive data retrieval capabilities

Filtering

Basic filtering based on user attributes

Advanced filtering based on various user attributes and relationships

Performance

It is slower for large datasets

Potentially faster for large datasets

Security Focus

Limited security-based filtering

Integrates with Azure AD security features for filtering

Best use case

Existing scripts using MSOnline module

New development projects and scripts

While they share similarities, Get-AzureADUser offers significant advantages as the actively supported cmdlet:

  • Future Compatibility: Get-MsolUser is deprecated, potentially causing issues with future Azure AD updates.

  • Enhanced Features: Get-AzureADUser offers a wider range of data retrieval options, advanced filtering, and potential performance improvements.

  • Security Focus: Get-AzureADUser integrates with Azure AD security features for more secure filtering.


Transitioning from Get-MsolUser to Get-AzureADUser

As Microsoft actively promotes the Microsoft Graph API and deprecates older functionalities, transitioning from Get-MsolUser to Get-AzureADUser becomes crucial for developers working with user management in Azure AD through PowerShell. Here's a detailed breakdown of the transition process, its rationale, and step-by-step guidance.

Reasons for the Transition:

  • Future-Proofing: Get-MsolUser utilizes the older Azure AD Management API, which is being phased out. Get-AzureADUser leverages the Microsoft Graph API, ensuring compatibility with future Azure AD updates and functionalities.

  • Enhanced Functionality: Get-AzureADUser offers access to a wider range of data points, advanced filtering capabilities, and potential performance improvements compared to Get-MsolUser.

  • Security Focus:  Get-AzureADUser integrates with Azure AD security features, allowing for more robust security-based filtering within scripts.


Here is the step-by-step guide on the transition from Get-MsolUser to Get-AzureADUser

STEP 1. Inventory and Analyze Existing Scripts:

Identify all scripts within your environment that currently utilize Get-MsolUser for user management tasks in Azure AD.


For each script, carefully analyze its functionality. Specifically, understand:

  • Targeted User Information: What specific user attributes (e.g., name, license assignment, department) does the script retrieve or filter for?

  • Filtering Criteria: Does the script use any filtering based on user properties (e.g., finding users with a specific license type)?


STEP 2. Replace Get-MsolUser with Get-AzureADUser:

Update your scripts to replace instances of Get-MsolUser with Get-AzureADUser. Key considerations:


Targeting Users:

  • The syntax for targeting specific users remains similar. You can use the -UPN parameter for UserPrincipalName or -ObjectId for the user's unique identifier.

  • For advanced filtering based on user attributes, leverage the -Filter parameter with Get-AzureADUser.


Data Retrieval:

  • While the core user attributes retrieved (name, UPN, license) might be similar, there could be slight differences between Get-MsolUser and Get-AzureADUser.

  • After replacing the cmdlet,  within your script examine the retrieved user object properties to ensure it captures the necessary information.


Example (Scenario: Finding Users with No Licenses):

Original Script (Using Get-MsolUser):

# Get-MsolUser based Script (original)
$unlicensedUsers = Get-MsolUser -Filter {$_.isLicensed -eq $false}

# Process retrieved unlicensed users (e.g., display UPN)
$unlicensedUsers | ForEach-Object { Write-Host $_.UserPrincipalName }

Updated Script using Get-AzureADUser:

# Updated Script using Get-AzureADUser
$unlicensedUsers = Get-AzureADUser -Filter "licenseAssignment -eq $null"

# Process retrieved unlicensed users (e.g., display UPN)
$unlicensedUsers | ForEach-Object { Write-Host $_.UserPrincipalName }

The original script uses Get-MsolUser with a filter checking for isLicensed -eq $false (users without licenses).


The updated script replaces Get-MsolUser with Get-AzureADUser. The filter syntax changes slightly to "licenseAssignment -eq $null" and achieves the same result.


STEP 3. Testing and Validation:

After updating the cmdlets, rigorously test your scripts to verify they:

  • Retrieve the correct user information using Get-AzureADUser.

  • Perform the desired user management tasks effectively.


STEP 4. Documentation Update:

Update the documentation for your scripts to reflect the transition to Get-AzureADUser. This includes:

  • Mentioning the replacement of Get-MsolUser.

  • Highlighting any changes in filtering or data retrieval behavior due to the switch.


Conclusion

This guide explored Get-MsolUser (deprecated) and Get-AzureADUser for managing Azure AD users in PowerShell.

Key Takeaways:

  • Get-AzureADUser is the actively supported and future-proof option.

  • It offers wider data retrieval, advanced filtering, and potential performance improvements.

  • Transitioning ensures script compatibility and unlocks security integration benefits.


Embrace the future of Azure AD user management with Get-AzureADUser!

Recent Posts

See All

Комментарии


bottom of page