Microsoft Entra PowerShell: the AzureAD successor

Microsoft retired the AzureAD and MSOnline modules in 2025. Scripts using Connect-AzureAD, Get-AzureADUser or Get-MsolUser no longer work. There are two successors: Microsoft.Entra, with cmdlet names close to the old ones, and Microsoft.Graph, the general Graph SDK. Both use the same Microsoft Graph API under the hood.

Which one to choose?

• Microsoft.Entra if you have many old AzureAD scripts. The names are similar (Get-EntraUser), and a compatibility mode lets the old names work.
• Microsoft.Graph for new scripts that also go beyond Entra ID: mail, SharePoint, Teams. One module for everything.

Combining is fine: Microsoft.Entra is built on the Microsoft.Graph authentication.

Installing and connecting

Install-Module Microsoft.Entra -Repository PSGallery -Scope CurrentUser -Force -AllowClobber
Connect-Entra -Scopes 'User.Read.All','Group.Read.All'
Get-EntraUser -Top 5 | Select-Object DisplayName, UserPrincipalName

For preview features there is Microsoft.Entra.Beta. For unattended scripts Connect-Entra works like Connect-MgGraph: with -ClientId, -TenantId and -CertificateThumbprint, or -Identity for a managed identity.

Getting old scripts running quickly

With Enable-EntraAzureADAlias the session recognises the old AzureAD names and routes them to the Entra cmdlets. Put it right after connecting:

Connect-Entra -Scopes 'User.Read.All'
Enable-EntraAzureADAlias
Get-AzureADUser -Top 5   # runs Get-EntraUser

Treat this as a bridge, not the destination. Parameters and output are not always identical; test every script and then really replace the old names.

Common replacements

• Get-AzureADUser -ObjectId x → Get-EntraUser -UserId x or Get-MgUser -UserId x
• Get-AzureADGroupMember → Get-EntraGroupMember or Get-MgGroupMember
• Get-MsolUser -All → Get-EntraUser -All or Get-MgUser -All
• Get-AzureADDirectoryRoleMember → Get-EntraDirectoryRoleMember

Error messages

• Connect-AzureAD is not recognized: expected; the old module is gone or not loaded. Move over as shown above.
• An old script still runs but returns nothing or odd results: it probably uses MSOnline cmdlets that no longer get an answer. Search the script for Msol and AzureAD.
• Insufficient privileges: the scope is missing. Reconnect with the right -Scopes; see Connecting with Microsoft Graph for the AADSTS codes.

Working in PowerShell 7? Recommended; see Installing PowerShell 7.