Skip to content
Back to the Handbook
Free direct downloadMicrosoft 365Security

Evidence Snapshot for Microsoft 365

Read-only PowerShell and KQL examples for Secure Score, inactive licensed users and failed sign-in bursts.

Download the ZIPSee the files

No account and no email needed. An optional email copy is below.

How to use it

How to use this pack

A compact evidence starter for operators who need repeatable Microsoft 365 posture snapshots without changing tenant configuration. The examples export Secure Score and licensed-user findings locally, while the KQL query provides a bounded failed sign-in starting point.

  1. Read PREREQUISITES.md and request only the Graph read scopes it names.
  2. Run the two PowerShell scripts; the exports stay on your machine.
  3. Run the KQL query in your Sentinel workspace.

Before you rely on it

Exports can contain personal and security data. Confirm authority, Graph permissions, storage and retention before use.

Want a copy in your inbox?

Optional email delivery makes the link easy to recover. You can download above without submitting anything.

Used only to fulfil this request. Read the privacy notice.

Published by Michal Jatczak, trading as ITSailor.SHA-256 for this pack