Skip to main content

Microsoft Entra ID via PowerShell

Runs nc-export-entra.ps1 in live mode — it calls Microsoft Graph directly on your behalf and skips exporting JSON by hand. If you would rather not install anything, use the Graph Explorer path instead; both produce the same output file.

Read the privacy statement first if you have not already — this page assumes you know what the script does and does not send.

Step 0 — get the script​

Download nc-export-entra.ps1 from the downloads page and verify its checksum before you run it. The commands below assume you run them from the same directory you downloaded it into.

Before you start​

  • PowerShell 7+ (pwsh).
  • The Microsoft Graph PowerShell SDK (Install-Module Microsoft.Graph if you don't already have it) — the script calls Connect-MgGraph and Invoke-MgGraphRequest from it.
  • An account that can consent to the three read-only Graph scopes below. Depending on your tenant's consent settings, that may require an administrator to grant or pre-approve them.

What it asks for, and why​

Live mode requests exactly these three delegated scopes — no more:

ScopeWhy
User.Read.AllResolve the users behind each grant
Application.Read.AllResolve the OAuth clients (apps) behind each grant
Directory.Read.AllRead oauth2PermissionGrants and app-role assignments across the directory

Nothing broader than read access to the directory objects the report needs. After you consent, the script checks that all three were actually granted — if your tenant's consent flow silently dropped one, it fails loudly rather than exporting a partial result and letting you believe it was complete.

Run it​

.\nc-export-entra.ps1 -OutDir ./out

That is the whole command for live mode — no other flags are required. You will be prompted to sign in and consent the first time.

What you'll see​

On success, the script prints a summary and then its closing line:

Skipped rows: 0
Nothing has been sent anywhere. Review discover-export.ndjson, then upload it in the Discover app.

Skipped rows is always printed, even when it is 0 — a row with a missing or unresolvable identity field is skipped with a warning rather than silently dropped, and this line is how you'd know.

After it finishes​

  1. Open ./out/discover-export.ndjson and read it. It is plain newline-delimited JSON — see the export format page if you want the exact field-by-field shape.
  2. Leave ./out/mapping.csv and ./out/salt.txt where they are. Neither is meant to leave your machine — see the privacy statement for what they're for.
  3. Upload discover-export.ndjson in the Discover app.
Screenshot pending

The upload flow is live in Discover; a screenshot of this step is still being prepared and will be added here.

Next​