Step 1 of 2 · the review

Run your review, get your report in minutes

Your IT admin (or whoever manages your Microsoft 365) does this once, on their own Windows computer. Nothing is installed on your network, and nothing in your Microsoft 365 is changed.

  1. Download the review script

    Download Invoke-M365Review.ps1

    Save it somewhere easy to find, like your Downloads folder. It is licensed for your own organisation's Microsoft 365 only: copying, changing or passing it on is not permitted. By running it you agree to our terms of use.

  2. Check it is the file we tested

    Open PowerShell the ordinary way, not "Run as administrator" (nothing here needs administrator rights, and Microsoft's sign-in can fail from an administrator window). Go to the folder you saved it in (for example cd $HOME\Downloads), and run:

    (Get-FileHash .\Invoke-M365Review.ps1 -Algorithm SHA256).Hash -eq '4424447C57AB58CC12FCD1F1A3FE1E641820FA076F67EAC56034C6F5E59B6FFC'

    It prints True when your copy is byte for byte the one we tested and published. Its fingerprint is 4424447C57AB58CC12FCD1F1A3FE1E641820FA076F67EAC56034C6F5E59B6FFC, the same one on our home page.

    False? Do not run it. Download it again from this page; if it still says False, email us.

  3. Add Microsoft's sign-in module, once per computer

    In the same PowerShell window, paste this on its own and press Enter:

    Install-Module Microsoft.Graph.Authentication -Scope CurrentUser

    It is Microsoft's own module, from the PowerShell Gallery, and only for your Windows account. The first time, Windows asks one or two questions about NuGet and an "untrusted repository": answer Y to each, and wait until the prompt comes back. If it says the module is already installed, that is fine — go straight on.

  4. Run it

    Paste this and press Enter. No code and no email address are needed: the report is made and saved on this computer, and nothing about you or your Microsoft 365 is sent anywhere.

    Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
.\Invoke-M365Review.ps1 -Pdf -Open

    A Microsoft sign-in window opens. Sign in as a Global Administrator, or as someone with the Global Reader, Reports Reader and Security Reader roles (without Security Reader the report leaves out your Microsoft Secure Score). Microsoft shows you the exact read-only permissions before you approve anything.

    When it finishes, your report opens and is saved on that computer in a folder called M365-Review-Output. Forward report.pdf to whoever asked for it.

Want to see it first?

Run .\Invoke-M365Review.ps1 -Demo -Open instead of the command above. No sign-in, no real data: it makes up a fictional company and shows you exactly what your own report will look like. -ShowPermissions prints the full list of what it reads, also without signing in.

After the report: step 2, clean up (optional)

The review changes nothing. If you decide to act on what it finds, the owner first decides each line in the Excel workbook saved with the report. Then your admin makes the changes by hand, following the steps under each finding in the Microsoft 365 admin center: tips that save trouble are on the clean-up page. A clean-up tool that makes the marked changes for you is coming soon.

Running it again next month

Waste comes back as people join and leave. Run the same command from the same folder, and add the -CompareWith line the script printed at the end of this run: the new report then shows what was fixed, who joined and left, and whether the score moved.

What it does, and does not, do

  • Reads only. Every request it makes to Microsoft is a read - it cannot change a licence, an account or a setting even if you asked it to.
  • Never sees email content, files, chats or passwords.
  • Sends none of your data anywhere. The report is made and saved on your computer only. Its one request outside Microsoft asks our site for the latest version number, so it can warn you if your copy is out of date (-SkipVersionCheck turns it off).
  • We never receive your report - we do not keep a copy on any server.

If something goes wrong

"Running scripts is disabled on this system"

The first line of the run command fixes this, for that PowerShell window only. Run the whole command again in the same window, starting with Set-ExecutionPolicy.

It asks about NuGet or an "untrusted repository"

That is Windows installing Microsoft's own sign-in module from the PowerShell Gallery for the first time. Answer Y to both. It only happens once on that computer.

"Unable to resolve package source" or "No match was found"

Older copies of Windows PowerShell reach the PowerShell Gallery with an out-of-date security setting. Run this in the same window, then the install line again:

[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12

The sign-in window never appears, or it says "accounts control"

Look behind your other windows first. If PowerShell was opened with "Run as administrator", or as a different user from the one signed in to Windows, close it, open it the ordinary way and run the same command again: Microsoft's sign-in uses Windows' own account window, which can fail from an administrator window. For a computer with no browser at all, add -DeviceCode to the end of the command: it prints a short code to type in at Microsoft's sign-in page from any browser, on any device. It works only where your Microsoft 365 allows it: security defaults, which most small businesses use, block it.

Microsoft says an administrator must approve

The read-only permissions have to be approved once for your organisation. Someone with Global Administrator can run it the first time, or approve it for you; after that Global Reader, Reports Reader and Security Reader are enough.

Where is my report?

In the M365-Review-Output folder on the computer you ran it on, in a folder named for the run: open report.pdf (or report.html) and forward it to whoever asked for the review. The last lines on screen give the full path.

Anything else

Email ddbloom2@gmail.com with review-log.txt attached. Every run writes it in its own folder inside M365-Review-Output, and when something goes wrong the last lines on screen give its full path. It records what the review did and where it stopped, with no names, email addresses or codes in it. A person reads every message.

How did it go?

A free review is free, and you keep everything it finds. All we ask back is a couple of sentences we can quote, and fifteen minutes of what you'd change about it.

Or email ddbloom2@gmail.com. This box cannot carry a file, so for a problem with a run, email us with review-log.txt attached (see If something goes wrong). What you write here goes to us through Web3Forms, a form service: see privacy.