Jenis data Microsoft yang umum bisa Anda ambil (query/export) menggunakan PowerShell script

1) Windows (Server/Client) – Data Sistem & Keamanan

Modul bawaan PowerShell / Windows

• Inventaris host: OS, hardware, patch, driver PowerShellGet-ComputerInfo
  Get-HotFix
  Get-PnpDevice | Select-Object Class, FriendlyName, Status
  Show more lines
•  
• Layanan & proses PowerShellGet-Service
  Get-Process
  Show more lines
•  
• Event & audit (aplikasi, sistem, keamanan, PowerShell) PowerShellGet-WinEvent -LogName Security -MaxEvents 200
  Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; ID=4104}
  Show more lines
•  
• Jaringan (port/listener, adapter, IP) PowerShellGet-NetTCPConnection
  Get-NetAdapter | Get-NetIPConfiguration
  
  Show more lines
•  
• Endpoint AV (Defender lokal) PowerShellGet-MpComputerStatus
  Get-MpThreat
  Show more lines

2) Active Directory On‑Prem (AD DS)

Modul: ActiveDirectory (RSAT / AD PowerShell)

• Objek identitas: user, group, OU, komputer PowerShellGet-ADUser -Filter * -Properties mail, title, lastlogondate
  Get-ADGroup -Filter * | Select Name, GroupCategory, GroupScope
  Get-ADComputer -Filter * -Properties IPv4Address, OperatingSystem
  Get-ADOrganizationalUnit -Filter *
  Show more lines
•  
• Kebijakan & replikasi PowerShellGet-GPO -All
  Get-ADReplicationPartnerMetadata -Target * -Scope Site
  Show more lines
•  
• Audit dasar (akun nonaktif/kedaluwarsa) PowerShellSearch-ADAccount -AccountInactive -UsersOnly -TimeSpan 90.00:00:00
  
  Show more lines

3) Microsoft Entra ID (Azure AD) & Lisensi – via Microsoft Graph

Modul: Microsoft.Graph (alias Mg)

Koneksi

PowerShell

Connect-MgGraph -Scopes "User.Read.All","Group.Read.All","Directory.Read.All","AuditLog.Read.All","Reports.Read.All"

Select-MgProfile -Name beta # (opsional, jika perlu endpoint beta)
Show more lines

Data yang bisa diambil

• Pengguna & grup Plain TextGet-MgUser -All -Property Id,DisplayName,UserPrincipalName,AccountEnabled,AssignedLicenses
  Get-MgGroup -All -Property Id,DisplayName,MailEnabled,SecurityEnabled,GroupTypes
  Show more lines
•  
• Aplikasi & service principals PowerShellGet-MgApplication -All
  Get-MgServicePrincipal -All
  Show more lines
•  
• Perangkat terdaftar (Entra joined/hybrid) PowerShellGet-MgDevice -All -Property Id,DisplayName,DeviceId,OperatingSystem,ApproximateLastSignInDateTime
  Show more lines
•  
• Lisensi/sku PowerShellGet-MgSubscribedSku | Select SkuPartNumber, ConsumedUnits, SkuId
  Show more lines
•  
• Audit & sign‑in logs (perlu AuditLog.Read.All) PowerShellGet-MgAuditLogSignIn -All | Select UserDisplayName,UserPrincipalName,AppDisplayName,Status,CreatedDateTime
  Get-MgAuditLogDirectoryAudit -All | Select ActivityDisplayName,InitiatedBy,Result,ActivityDateTime
  Show more lines

4) Exchange Online (Mailbox, Transport, Compliance)

Modul: ExchangeOnlineManagement

Koneksi

PowerShell

Connect-ExchangeOnline

``
Show more lines

Data yang bisa diambil

• Mailbox & statistik PowerShellGet-EXOMailbox -ResultSize Unlimited | Select DisplayName,UserPrincipalName,RecipientTypeDetails,MailboxPlan
  Get-EXOMailboxStatistics -Identity [email protected] | Select ItemCount,TotalItemSize,LastLogonTime
  Show more lines
•  
• Distribusi & dynamic groups PowerShellGet-DistributionGroup
  Get-DynamicDistributionGroup
  Show more lines
•  
• Transport rules, connectors PowerShellGet-TransportRule
  Get-InboundConnector; Get-OutboundConnector
  Show more lines
•  
• Compliance/Audit (Purview) – Unified Audit Log PowerShellSearch-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -Operations MailItemsAccessed
  Show more lines

5) SharePoint Online & OneDrive

Modul: Microsoft.Online.SharePoint.PowerShell (SPO) atau sebagian via Graph

• Tenant & site collections PowerShellConnect-SPOService -Url https://<tenant>-admin.sharepoint.com
  Get-SPOTenant
  Get-SPOSite -Limit All | Select Url, StorageUsageCurrent, Owner, Template
  Show more lines
•  
• Izin & grup site PowerShellGet-SPOSiteGroup -Site https://<tenant>.sharepoint.com/sites/IT
  
  Show more lines
•  
• OneDrive (personal site) info PowerShellGet-SPOSite -IncludePersonalSite $true -Limit All | Where-Object {$_.Template -eq 'SPSPERS'}
  Show more lines

6) Microsoft Teams (Teams, Channel, Policies, Voice)

Modul: MicrosoftTeams (+ SkypeForBusiness untuk sebagian cmdlet voice lama)

• Tim & channel PowerShellConnect-MicrosoftTeams
  Get-Team
  Get-TeamChannel -GroupId <GroupId>
  Show more lines
•  
• Pengguna Teams & kebijakan PowerShellGet-CsOnlineUser -Identity [email protected] | Select DisplayName, TeamsUpgradeEffectiveMode, EnterpriseVoiceEnabled
  Get-CsTeamsMeetingPolicy
  Get-CsTeamsMessagingPolicy
  Show more lines
•  
• Calling/Phone System (jika dipakai) PowerShellGet-CsOnlinePSTNGateway
  Get-CsPhoneNumberAssignment -Capability VoiceApplication
  Show more lines

7) Microsoft Intune (Endpoint Manager) – via Graph

Modul: Microsoft.Graph (device management)

• Perangkat terkelola PowerShellGet-MgDeviceManagementManagedDevice -All | Select DeviceName,UserDisplayName,ComplianceState,OSVersion,LastSyncDateTime
  Show more lines
•  
• Kepatuhan & konfigurasi PowerShellGet-MgDeviceManagementDeviceCompliancePolicy -All | Select DisplayName,Platforms,CreatedDateTime
  Get-MgDeviceManagementDeviceConfiguration -All | Select DisplayName
  
  Show more lines
•  
• Aplikasi terkelola PowerShellGet-MgDeviceAppManagementMobileApps -All | Select DisplayName,Publisher,IsFeatured
  Show more lines

8) Microsoft Defender (Security) – via Graph Security/M365 Defender

Modul: Microsoft.Graph (security), atau modul spesifik produk jika tersedia

• Insiden & alert PowerShellConnect-MgGraph -Scopes "SecurityEvents.Read.All"
  Get-MgSecurityAlert -All | Select Title,Severity,Status,CreatedDateTime
  
  Show more lines
•  
• Endpoint (Defender for Endpoint) via Graph → daftar perangkat/status, indikator, dll.
  (Perlu izin aplikasi/delegasi yang sesuai dan seringkali app registration)

9) Layanan Azure (IaaS/PaaS) – Resource Inventory & Metering

Modul: Az (Az.Accounts, Az.Resources, Az.Compute, Az.Network, dsb.)

Koneksi

PowerShell

Connect-AzAccount
Show more lines

Contoh data

• Inventaris resource PowerShellGet-AzResource | Select Name,ResourceType,ResourceGroupName,Location
  Show more lines
•  
• VM, NIC, IP, NSG PowerShellGet-AzVM
  Get-AzNetworkInterface
  Get-AzPublicIpAddress
  Get-AzNetworkSecurityGroup
  
  Show more lines
•  
• Storage & SQL PowerShellGet-AzStorageAccount
  Get-AzSqlServer; Get-AzSqlDatabase
  Show more lines

10) Laporan & Analytics Microsoft 365 (Graph Reports)

Modul: Microsoft.Graph.Reports

• Penggunaan layanan (aktifitas user, registrasi MFA, dll.) PowerShellGet-MgReportAuthenticationMethodsUserRegistrationDetail
  Get-MgReportOffice365ActivationCounts
  # Banyak laporan disediakan dalam format CSV dari endpoint /reports
  Show more lines

11) Microsoft Purview (Compliance) – eDiscovery, DLP, Audit

Modul: campuran (Exchange Online/Compliance PowerShell) + Graph

• Unified Audit Log (lihat bagian Exchange Online)
•  
• Labeling/DLP (banyak via portal/API; PowerShell sebagian besar lewat EXO/Graph – tergantung skenario)

12) Praktik Terbaik Pengambilan Data

• Paging & throttling: gunakan -All (Graph) atau -Top/-PageSize, dan loop halaman bila perlu.
•  
• Seleksi kolom: selalu Select kolom yang dibutuhkan agar cepat & hemat kuota.
•  
• Ekspor: gunakan Export-Csv -NoTypeInformation -Encoding UTF8 untuk pelaporan.
•  
• Otorisasi minimum: minta scopes sehemat mungkin (principle of least privilege).
•  
• Sekuritas: simpan token/kredensial di SecretStore/Key Vault; hindari plaintext.

13) Contoh “quick‑win” pelaporan gabungan (M365)

Daftar user M365 + lisensi + login terakhir (Entra sign‑in)

PowerShell

# Login Graph

Connect-MgGraph -Scopes "User.Read.All","Directory.Read.All","AuditLog.Read.All"

Select-MgProfile beta

$users = Get-MgUser -All -Property Id,DisplayName,UserPrincipalName,AssignedLicenses,AccountEnabled

$report = foreach($u in $users){

$signIn = Get-MgAuditLogSignIn -Filter "userId eq '$($u.Id)'" -Top 1 -OrderBy "createdDateTime desc"

[pscustomobject]@{

DisplayName = $u.DisplayName

UPN = $u.UserPrincipalName

Enabled = $u.AccountEnabled

Licenses = ($u.AssignedLicenses.skuId -join ';')

LastSignInAt = $signIn.CreatedDateTime

LastSignInApp = $signIn.AppDisplayName

}

}

$report | Export-Csv .\\M365_User_License_SignIn.csv -NoTypeInformation -Encoding UTF8
Show less

sumber: gap.web.id