Microsoft Graph PowerShell: How to Test Module

To test a Microsoft Graph PowerShell module, you first install it, then run Connect-MgGraph to authenticate, and finally execute a simple cmdlet like Get-MgUser -Top 1 to verify connectivity and permissions. This article walks through the full process, including checking module versions, handling authentication errors, and validating that your app permissions are correct.

Background: Why Testing Matters

Microsoft Graph PowerShell is a module that wraps the Microsoft Graph REST API, letting you manage Azure AD, Microsoft 365, and other cloud resources from the command line. Unlike the older AzureAD and MSOnline modules, it uses modern OAuth 2.0 and supports both delegated and application permissions. Testing a module installation is essential because a broken module or misconfigured permissions can cause scripts to fail silently or produce incomplete results. A quick test after installation saves time and prevents confusion when you later run a larger automation script.

Prerequisites and Installation

Before testing, you need PowerShell 5.1 or later (PowerShell 7 is recommended) and the module itself. Install the module from the PowerShell Gallery:

Open PowerShell as an administrator (for system-wide install) or as a regular user (for a per-user install).
Run Install-Module Microsoft.Graph -Scope CurrentUser to install the main module, which includes all submodules.
If you only need a few modules, install specific ones like Microsoft.Graph.Users or Microsoft.Graph.Groups to reduce load time.
After installation, verify the module loaded correctly with Get-Module -ListAvailable Microsoft.Graph.

If you already have an older version, update it with Update-Module Microsoft.Graph. Note that the module has many submodules; installing the main module installs all of them, which can take several minutes.

Step-by-Step Testing Process

Once installed, follow these steps to test the module:

Import the module (usually automatic, but you can force it): Import-Module Microsoft.Graph.
Connect to Graph: Connect-MgGraph -Scopes "User.Read.All", "Group.Read.All". This opens a sign-in window (or device code flow) and requests the specified permissions.
Run a simple query: Get-MgUser -Top 1 – this retrieves the first user in your tenant. If it returns a user object, the module is working.
Test a different resource: Get-MgGroup -Top 1 to verify group access.
Check the connection status: Get-MgContext shows your current connection details, including the account and scopes.

If the cmdlet returns data, your module is functional. If you get an error, see the troubleshooting section below.

Common Errors and How to Fix Them

Several errors can occur during testing:

“Connect-MgGraph: The term ‘Connect-MgGraph’ is not recognized” – This means the module isn’t installed or not imported. Run Install-Module Microsoft.Graph and then Import-Module Microsoft.Graph.
“Insufficient privileges to complete the operation” – The signed-in user lacks the required Graph permissions. Reconnect with the correct scopes: Disconnect-MgGraph then Connect-MgGraph -Scopes "User.Read.All".
“Access token expired” – Reauthenticate by running Connect-MgGraph again. You can also clear cached tokens with Disconnect-MgGraph.
“The requested resource is not a directory resource” – This often happens when you use a v1.0 endpoint cmdlet on a beta-only resource. Ensure you’re using the correct module (e.g., Microsoft.Graph.Beta for beta features).

For authentication issues, check the scopes you requested. The Graph API requires specific permission scopes for each operation; missing scopes lead to 403 errors.

Testing with Application Permissions (Non-Interactive)

If you’re running scripts in CI/CD or as a background job, you’ll use application permissions with a client secret or certificate. Test this way:

Register an app in Azure AD and grant it application permissions (e.g., User.Read.All) with admin consent.
In PowerShell, use the client secret flow:

$clientSecret = "your-client-secret"
$tenantId = "your-tenant-id"
$clientId = "your-client-id"
$secureSecret = ConvertTo-SecureString $clientSecret -AsPlainText -Force
$clientSecretCredential = New-Object System.Management.Automation.PSCredential($clientId, $secureSecret)
Connect-MgGraph -TenantId $tenantId -ClientSecretCredential $clientSecretCredential

Then run Get-MgUser -Top 1. If it works, your app permissions are correctly configured. Remember to store secrets securely using Azure Key Vault or environment variables.

Verifying Module Version and Integrity

To ensure you’re testing the right version, check the module details:

Get-Module Microsoft.Graph | Select-Object Name, Version – shows the loaded version.
Find-Module Microsoft.Graph | Select-Object Version – shows the latest available version.
If they differ, update with Update-Module Microsoft.Graph.

Also, check the module’s help to confirm a cmdlet exists: Get-Command -Module Microsoft.Graph.Users lists all cmdlets in that submodule. This is useful when you suspect a cmdlet is missing.

Frequently Asked Questions

How do I test if Microsoft Graph PowerShell is installed?

Run Get-Module -ListAvailable Microsoft.Graph. If you see a version listed, it’s installed. If not, install it with Install-Module Microsoft.Graph.

Why does Connect-MgGraph fail with an error?

Common causes include incorrect scopes, unsupported account types, or network issues. Check that you’re using a supported account (work/school or Microsoft personal) and that the scopes are valid. Try Connect-MgGraph -Scopes "User.Read" for a minimal test.

Can I test the module without admin rights?

Yes, for delegated permissions, you just need a user account that can sign in. For application permissions, you need admin consent, but the testing itself can be done by a non-admin if the app has been consented.

How do I test a specific submodule like Microsoft.Graph.Users?

Install that submodule with Install-Module Microsoft.Graph.Users, then import it and test with Get-MgUser -Top 1. Make sure you’re connected with the appropriate scopes.

What does “The term ‘Get-MgUser’ is not recognized” mean?

That cmdlet isn’t in the loaded module. You likely haven’t installed the Microsoft.Graph.Users submodule, or you haven’t imported the main module. Install the full module or the specific submodule, then import it.

How do I test the module in an automated script?

Use the application permission flow with a client secret or certificate, and wrap your test in a try/catch block. For example: try { Get-MgUser -Top 1 } catch { Write-Error $_.Exception.Message }. This lets you log failures.

Alternatives and Comparisons

If you’re migrating from the AzureAD module, note that Microsoft.Graph uses different cmdlet names (e.g., Get-AzureADUser becomes Get-MgUser). The Graph module is the future, as AzureAD is deprecated. For simple read-only queries, you might also use the Graph Explorer web tool, but testing the PowerShell module is necessary for automation. The Graph SDK also exists for .NET, but PowerShell is the most direct for scripting.

Testing your Microsoft Graph PowerShell module is a straightforward process that ensures your environment is ready for automation. By following the steps above, you can quickly identify and resolve issues, saving time when you move to production scripts.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →