← PS C:\Blog\rksolutions> cd ..

RKSolutions PowerShell Module

· 7 min read · Roy Klooster
Entra ID Graph API Intune Reports Tools

If you manage Microsoft 365 tenants, you already know the value of a single view for enrollment flows, anomalies, admin roles, license assignment, and custom security attributes. But automation and scripting often mean wrestling with Microsoft Graph APIs, building your own auth and error handling, and maintaining scripts that break when the API changes. RKSolutions is a PowerShell module that connects once to Microsoft Graph and lets you run Intune enrollment flows, Intune anomalies, Entra admin roles, M365 license assignment, and Custom Security Attributes reports from the command line or your own scripts, with consistent connection handling, multiple auth methods, and HTML (and optionally CSV/Excel) output. This guide explains what it does, how to use it, and how you can contribute or ask for new features.

Table of Contents

What is the RKSolutions PowerShell module?

RKSolutions is a PowerShell script module that talks to the Microsoft Graph API to produce report-style output (HTML by default, with optional CSV or Excel). The reports were first released as separate scripts on the PowerShell Gallery; the module brings them together in one install with shared auth and consistent parameters.

What it gives you:

  • Connect once, run every report: Authenticate with Microsoft Graph (interactive, Client Secret, Certificate, Managed Identity, or Access Token).
  • Six report cmdlets, one module: Intune enrollment flows, Intune anomalies, Entra admin roles, M365 license assignment, and Custom Security Attributes — all from a single Install-Module.
  • Consistent behavior: All report cmdlets use the same connection from Connect-RKGraph; they support parameters such as -ExportPath, -SendEmail, -Recipient, and -From where applicable, and share the same permission model so one connection covers all reports.
  • Unified report design: Every report uses a shared HTML template with consistent branding, Geist/Geist Mono typography, light/dark theme toggle, and interactive DataTables with search, export (Excel/CSV/PDF), and column visibility controls.
  • **PowerShell 7.0+: Runs on Windows, macOS, and Linux.
  • No secrets in scripts: Credentials are handled by the Microsoft Graph session; you connect once with Connect-RKGraph and then run as many report commands as you need.
  • Tab completion and help: Every cmdlet has comment-based help; Get-Help Connect-RKGraph -Full and tab completion on parameters work out of the box.

Where to find it:

What’s new in v1.1.0

New report: Custom Security Attributes. Get-CustomSecurityAttributesReport auto-discovers all attribute sets in your tenant and generates an interactive report showing which users, devices, and enterprise applications have which attributes assigned. The report includes an overview tab with a coverage matrix, plus a dedicated tab per attribute set with searchable tables. If you’ve set up Custom Security Attributes following our Forgotten Features Part 3 guide, this cmdlet gives you instant visibility into how they’re being used.

# Discover and report all attribute sets
Get-CustomSecurityAttributesReport

# Report on a specific attribute set
Get-CustomSecurityAttributesReport -AttributeSet "ComplianceData"

Unified report design. All reports now share the same HTML template with consistent branding, Geist/Geist Mono typography, pill-style tab navigation, light/dark theme toggle, and interactive DataTables with search, export, and column visibility. The standalone scripts each had their own HTML — the module unifies them into one polished design.

Security hardening. All report generators now HTML-encode Graph API data before rendering, preventing stored XSS through display names or attribute values. Filter dropdowns use safe DOM API methods, and the email sender parameter is validated before use.

Performance. Hot loops that previously used PowerShell’s quadratic $array += pattern now use List[PSObject].Add() for linear performance in large tenants.

Requirements

  • Powershell 7.0 or higher
  • Module: Microsoft.Graph.Authentication (required by RKSolutions; install via Install-Module Microsoft.Graph.Authentication).
  • Permissions:Connect-RKGraph uses a default set of Microsoft Graph scopes so one connection works for all report cmdlets. Grant these to your app or consent interactively as needed. Full list and per-cmdlet breakdown: docs/PERMISSIONS.md.
    • User.Read
    • User.Read.All
    • Group.Read.All
    • GroupMember.Read.All
    • Device.Read.All
    • DeviceManagementConfiguration.Read.All
    • DeviceManagementApps.Read.All
    • DeviceManagementManagedDevices.Read.All
    • DeviceManagementServiceConfig.Read.All
    • Directory.Read.All
    • Organization.Read.All
    • AuditLog.Read.All
    • RoleManagement.Read.Directory
    • RoleAssignmentSchedule.Read.Directory
    • PrivilegedEligibilitySchedule.Read.AzureADGroup
    • Mail.Send
    • CloudLicensing.Read
    • CloudPC.Read.All
    • CustomSecAttributeAssignment.Read.All
    • CustomSecAttributeDefinition.Read.All

Installation

Install-Module -Name RKSolutions -Scope CurrentUser

Option 2: From source (GitHub)

git clone https://github.com/royklo/RKSolutions-Module.git
cd RKSolutions-Module
Import-Module ./module/RKSolutions.psd1 -Force

Important: When loading from source, always run Import-Module from the repository root and use the path ./module/RKSolutions.psd1.

Key Cmdlets and Use Cases

Cmdlet What it does
Connect-RKGraph Establishes a Microsoft Graph session (Interactive, ClientSecret, Certificate, Identity, or AccessToken).
Disconnect-RKGraph Clears the session and disconnects.
Get-IntuneEnrollmentFlowsReport Assignment overview only (-AssignmentOverviewOnly) or device-level flow for a given device (-Device). Optional -MermaidOverview to export a .mmd diagram. Output: HTML and optionally CSV.
Get-IntuneAnomaliesReport Intune anomalies HTML report. Optional email: -SendEmail, -Recipient, -From. Optional -ExportPath.
Get-EntraAdminRolesReport Entra ID admin roles HTML report. Optional -SendEmail, -Recipient, -From, -ExportPath, -DebugMode.
Get-M365LicenseAssignmentReport M365 license assignment HTML report with filtering and export to Excel, CSV, or PDF. Optional -SendEmail, -Recipient, -From, -ExportPath.
Get-CustomSecurityAttributesReport Custom Security Attributes report across users, devices, and enterprise apps. Auto-discovers all attribute sets or targets a specific one with -AttributeSet. Optional -SendEmail, -Recipient, -From, -ExportPath.

Typical workflows:

  • Tenant and assignment overview: Connect-RKGraph → Get-IntuneEnrollmentFlowsReport -AssignmentOverviewOnly to see all Intune assignments in one HTML report.
  • Device troubleshooting: Get-IntuneEnrollmentFlowsReport -Device 'DeviceName' (or Intune device ID / Entra device object ID) for a step-by-step flow
  • Compliance and auditing: Get-EntraAdminRolesReport and Get-M365LicenseAssignmentReport for admin roles and license assignment; use -ExportPath to save to a specific location, or -SendEmail to mail the report.
  • Custom Security Attributes: Get-CustomSecurityAttributesReport to report on attribute assignments across users, devices, and enterprise apps with coverage metrics.

For full parameter details and example output, see the Cmdlet Reference in the repository: docs/CMDLET-REFERENCE.md. For which Graph permissions each cmdlet uses: docs/PERMISSIONS.md.

Quick Start

After installing the module, connect once with Connect-RKGraph, then run any report cmdlet. When you’re done, run Disconnect-RKGraph.

1. Connect (interactive)

A browser opens for sign-in. After consent, the session is stored and all report cmdlets use it.

Connect-RKGraph

2. Run a report

Pick any of the report cmdlets. Each produces an HTML file in the current folder by default.

# Intune assignment overview (all profiles, compliance policies, app assignments; no device needed)
Get-IntuneEnrollmentFlowsReport -AssignmentOverviewOnly

# M365 license assignment
Get-M365LicenseAssignmentReport

# Entra admin roles
Get-EntraAdminRolesReport

# Intune anomalies
Get-IntuneAnomaliesReport

# Custom Security Attributes (all sets auto-discovered)
Get-CustomSecurityAttributesReport

3. Intune flow for a specific device

Use -Device with the device name, Intune device ID, or Entra device object ID. Optionally export CSV or a Mermaid diagram.

Get-IntuneEnrollmentFlowsReport -Device 'DESKTOP-ABC123'

# With CSV export to a folder
Get-IntuneEnrollmentFlowsReport -Device 'DESKTOP-ABC123' -ExportToCsv -ExportFolder 'C:\Reports'

# Export the same flow as a Mermaid .mmd file
Get-IntuneEnrollmentFlowsReport -Device 'DESKTOP-ABC123' -MermaidOverview

4. Save report to a specific path

Use -ExportPath to control where the HTML (or other output) is written.

Get-M365LicenseAssignmentReport -ExportPath 'C:\Reports\M365-Licenses.html'
Get-EntraAdminRolesReport -ExportPath 'D:\Output\EntraRoles.html'

5. Email a report

Several report cmdlets support -SendEmail, -Recipient, and -From (requires Mail.Send and a valid From address).

Get-EntraAdminRolesReport -SendEmail -Recipient 'admin@contoso.com' -From 'reports@contoso.com'
Get-M365LicenseAssignmentReport -SendEmail -Recipient 'admin@contoso.com' -From 'reports@contoso.com'

6. Disconnect

Disconnect-RKGraph

For automation (scheduled tasks, CI), use Connect-RKGraph with -TenantId, -ClientId, and -ClientSecret, or with -CertificateThumbprint or -Identity. See the cmdlet reference for full parameter details.

You can use Get-Help <CmdletName> -Full for parameters and examples (e.g. Get-Help Get-IntuneEnrollmentFlowsReport -Full).

Output Formats and Filtering

  • Default output: All report cmdlets produce HTML by default, written to the current folder (or to the path you set with -ExportPath or report-specific path parameters).
  • CSV/Excel: Get-IntuneEnrollmentFlowsReport supports -ExportToCsv and -ExportFolder. Get-M365LicenseAssignmentReportsupports export to Excel, CSV, or PDF.
  • Export path: Use -ExportPath (or the cmdlet’s path parameter) to save the report to a specific file or folder.
  • Email: Several report cmdlets support -SendEmail, -Recipient, and -From (requires Mail.Send and a valid From address).

Example: run the license report and save to a custom path:

Get-M365LicenseAssignmentReport -ExportPath 'C:\Reports\M365-Licenses-2025.html'

Example: run the Entra admin roles report and email it:

Get-EntraAdminRolesReport -SendEmail -Recipient 'admin@contoso.com' -From 'reports@contoso.com'

How to Contribute

Contributions are welcome. The project uses a standard fork-and-pull-request workflow:

  • Fork the repository on GitHub: github.com/royklo/RKSolutions-Module.
  • Clone your fork and create a branch (e.g. feature/your-feature-name or fix/bug-description).
  • Make your changes under module/ (see CONTRIBUTING.md for development setup, code style, and the consistency contract).
  • Run tests from the repo root: Invoke-Pester ./Tests/Consistency.Tests.ps1 (see Tests/).
  • Commit and push to your fork, then open a pull request against the main repository. Fill in the PR template (summary, how to test, related issue if any).

New cmdlets must be added to module/Public/, registered in FunctionsToExport in the manifest, and documented in docs/CMDLET-REFERENCE.md. If a cmdlet calls Microsoft Graph, update its required scopes, Connect-RKGraph default scopes if needed, and docs/PERMISSIONS.md. The consistency tests must be updated if you add or change exported cmdlets or key parameters.

How to Request a Feature

Have an idea for a new cmdlet, parameter, or behaviour?

The feature you’d like (e.g. a new report, a new parameter, or a different output format).

  • The use case (why it would help you or others).
  • If you have one, a proposed solution (e.g. cmdlet name, parameters, example usage).

Not every request can be implemented immediately, but all are read and considered; they also help others discover and discuss ideas.

Conclusion

RKSolutions turns Microsoft Graph into a set of PowerShell report cmdlets you can use interactively or in scripts: connect once with Connect-RKGraph, then run Intune enrollment flows, Intune anomalies, Entra admin roles, M365 license assignment, and Custom Security Attributes reports with consistent connection handling and output. It’s a community project, not owned or maintained by Microsoft; feedback, bug reports, and feature requests from users like you shape what comes next. Install it from the PowerShell Gallery, try the quick start above, and if you hit a bug or have an idea, open an issue or send a pull request.

← back to all posts next: Forgotten Features Series, Part 5: The... →
PS Select-String -Pattern
↑↓navigate ↵open escclose