Get-MSOL* and Get-AzureAD*

Question

Get-MSOL* and Get-AzureAD*

Dale Peterson 61

Hello.

I haven't been to the forums for a while. I didn't see a category to post this under so I'm hoping it's all being handled by tags. Sorry if it's posted in the wrong spot.

I am studying for a MS exam and I'm really confused on when to use the Get-MSOL* and Get-AzureAD* cmdlets. If you want to know how many users have registered with MFA in your AAD tenant, you run Get-MsolUser. I would have thought that was something that was included in Get-AzureAD*. Is there a way to determine which of these cmdlets you should be run for a specific task? I would have thought anything to do with the Azure tenant would use the AzureAD cmdlets and MSOL for the M365 subscription. That logic doesn't seem to work with this though.

Any advice on this would be helpful.

Thanks!

Accepted answer

1 additional answer

Your answer

Answer 1

Limitless Technology 39,926

Hello DalePeterson

Get-AzureAD: allows user to manage Active Directory objects only, [where directory is hosted in Azure].

Get-MSOL: apart from managing Active Directory allows more administrative tasks such as Domain management, configure single sign-on etc.

Hope this clarifies your doubt. Reference

https://learn.microsoft.com/en-us/powershell/module/azuread/connect-azuread?view=azureadps-2.0

https://learn.microsoft.com/en-us/powershell/azure/active-directory/install-msonlinev1?view=azureadps-1.0

-----------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--

Dale Peterson 61 Reputation points

2022-01-24T16:55:55.337+00:00

Hi, @Limitless Technology .

Thanks for the reply. This is more what I needed. The useful differences between the two. I'm still a bit cloudy (no pun intended) on the differences, though. I'll get it. Every time I re-read your response I get a little closer to it clicking.

Answer 2

Hi @Dale Peterson • Thank you for reaching out.

All the identity information (Users, Groups, Applications, ServicePrincipals, Managed Identities, etc.) is stored in Azure AD. That means, if you use Get-MSOLUser or Get-AzureADUsers, the users' information will eventually be fetched from Azure Active Directory.

However, depending on which cmdlet you use, a different API is used in the backend to fetch the information from Azure AD.

If you use the Get-MSOLUser cmdlet, the API used in the backend will be https://provisioningapi.microsoftonline.com
If you use the Get-AzureADUsers cmdlet, it will use Graph API ( https://graph.windows.net/ or https://graph.microsoft.com)

Note: The information that you are trying to fetch, might be exposed via one API but not the other. E.g., you don't get the below properties with the Get-AzureADUsers cmdlet, which is why you need to use Get-MsolUser to know how many users have registered with MFA.

StrongAuthenticationMethod
StrongAuthenticationPhoneAppDetails
StrongAuthenticationProofupTime
StrongAuthenticationRequirements
StrongAuthenticationUserDetails
StrongPasswordRequired

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Dale Peterson 61 Reputation points

2022-01-24T16:53:21.293+00:00

Hi, @AmanpreetSingh-MSFT .

Thanks for replying to my inquiry. This is good information to use.

Share via

Get-MSOL* and Get-AzureAD*

1 additional answer

Your answer