PowerShell and Microsoft Entra ID: Automating User Provisioning Securely
PowerShell is one of the most powerful tools for Microsoft 365 and Entra ID administration — and one of the most abused by attackers. Here is how to use it effectively while minimizing your attack surface.
By Tom Brennan
Microsoft PowerShell is extraordinarily powerful for administrative tasks — and one of the most commonly abused tools in attacker toolkits through "living off the land" techniques.
Secure PowerShell Administration Practices
Constrained Language Mode
PowerShell Constrained Language Mode restricts the language to a safe subset that prevents many attack techniques. Enable it via AppLocker or Windows Defender Application Control (WDAC) policies.
Script Block Logging and Module Logging
Enable PowerShell script block logging in Group Policy. This captures all PowerShell activity — including obfuscated scripts — and sends it to the Windows Event Log where your SIEM can analyze it.
Secure Provisioning with CSV
For bulk user provisioning at scale, use a dedicated service account with only the permissions required for the task — not global admin. Validate CSV input before processing, log all provisioning actions, and rotate service account credentials after provisioning runs.
Monitoring PowerShell Activity
Key indicators to monitor: encoded command execution, downloads from the internet via IEX or Invoke-WebRequest, credential access patterns, and WMI-based execution. Our 24/7 MDR service monitors these patterns continuously.
Explore Related Resources