Sam Erde

@samerde.day3bits.com

Microsoft PowerShell MVP that is passionate about helping others succeed with Active Directory, Entra ID, Defender XDR, and Microsoft 365. Always learning! ✝️👨‍👩‍👧‍👦☕ OU=NC,OU=USA,DC=NA,DC=WORLD GitHub.com/SamErde Blog: day3bits.com

A picture of me at 25 years old with a Mohawk. I decided to have fun with it because I had recently started chemo and my hair was beginning to fall out!

GitHub on the web with the model section list open.

Prompt: "Looking ahead 3 months on my calendar, are there any days between Monday and Thursday that the 4-5 PM hour is consistently available? Does this trend repeat backwards as well?"

Initial Response: "I analyzed your calendar patterns using the available upcoming and past event data (over 100 meetings identified in the scan), focusing specifically on Monday–Thursday between 4–5 PM."

Anime styled image of an over-caffeinated engineer going nuts in the architectural design and requirements gathering phase.

The Register:
“ Unix was built on the philosophy of small programs that can be easily piped together to build larger workflows, so that, say, the output of grep can be combined with other material through the cat (concatenate) command. As a result, developers, admins, and now AI agents write scripts that incorporate these commands.”

The 'MCP Anchor' word mark in shades of blue, with the title on the right and an icon on the left. The primary elements of the icon are an anchor with a hexagonal-shaped shackle on top of the anchor, a CLI prompt in the center of the shackle, and node-like branches coming off the left side of the shackle (the ring at the top of the anchor).

A GitHub issue titled "my wife say's I am too literal." It is tagged as "wont fix: works as designed."

Prompt: Create a PowerShell script that uses the Microsoft.Entra module to list all users who are either directly assigned to or eligible for any Exchange Online or Compliance related privileged administrator roles in Entra ID. Also include accounts that are eligible for or directly assigned to the Global Administrator role.

Response from Gemini's Flash-Light with extended thinking: To perform this task, you should use the Microsoft.Graph module. While there are legacy modules (like AzureAD or MSOnline), Microsoft has consolidated all Entra ID management into the Microsoft.Graph SDK.

You're out of Codex messages. Your rate limit resets on 1:11 PM. To continue using Codex, add credits or upgrade to Pro today.

GitHub said there are merge conflicts. When I asked GitHub Copilot to resolve them, it responded that they are already resolved. They are not.

You are out of monthly free usage or have exceeded your budget for Codespaces. Increase your budget to continue using Codespaces.

Doug Rickard wrote to explain how Bones got its name. In 1988, he was working at MIT, with the Project Athena group. He was trying to get permission from the State Department to export Kerberos to Bond University in Australia. The State Department wouldn't allow it--not with DES included. To get it out of the country, they had to not only remove all calls to DES routines, but all comments and textual references to them as well, so that (superficially, at least) it was non-trivial to determine where the calls were originally placed.
To strip out all the DES calls and garbage, John Kohl wrote a program called piranha. At one of their progress meetings, Doug jokingly said, "And we are left with nothing but the Bones." For lack of a better term, he then used the word "Bones" and "boned" in the meeting minutes to distinguish between the DES and non-DES versions of Kerberos. "It somehow stuck," he says, "and I have been ashamed of it ever since."

Get-ADUser -SearchBase "OU=Users,OU=Tier2,DC=int,DC=day3bits,DC=com" -Filter *

Release Notes
1.2.0 - January 14th, 2026
Features
This release migrates the AgentId command set from MSIdentityTools into the entra‑powershell repository, delivering a production‑ready implementation for managing Agent Identity Blueprints and Agent Identities in Microsoft Entra ID.

Bug Fixes:
Enabled support for the -PreAuthorizedApplications parameter in the Set-EntraBetaApplication cmdlet, enabling users to configure pre-authorized applications for an Entra application.
The InvitedUser and InvitedUserMessageInfo parameter types have been updated. New New-EntraBetaInvitation commands now use interfaces from Microsoft.Graph.Beta.PowerShell.Models, while New-EntraInvitation commands use interfaces from Microsoft.Graph.PowerShell.Models.

$A screenshot of Windows Terminal running PowerShell 7 with default settings (no profile or nerd fonts). It shows several examples of using the Format-TimeSpan function: PS C:\> Format-TimeSpan -TimeSpan ([TimeSpan]::Zero) 0 seconds PS C:\> New-TimeSpan -Milliseconds 13500 | Format-TimeSpan -Abbreviate 13.50s PS C:\> New-TimeSpan -Days 1 -Hours 2 -Minutes 30 -Seconds 0 | Format-TimeSpan 1 days 2 hours 30 minutes PS C:\> $TimeSpan = New-TimeSpan -Milliseconds 1500 -Seconds 13 -Minutes 3 PS C:\> $TimeSpan | Format-TimeSpan -Abbreviate 3m 14s PS C:\>$

$Modules = Get-ModulesWithUpdate -PassThru
Searching for installed modules matching patterns: *
Found 133 installed modules.
Checking the source repository for newer versions of the modules...
Microsoft.Entra: 1.0.13 → 1.1.0 🆕
Microsoft.Entra.Applications: 1.0.13 → 1.1.0 🆕
Microsoft.Entra.Authentication: 1.0.13 → 1.1.0 🆕
Microsoft.Entra.CertificateBasedAuthentication: 1.0.13 → 1.1.0 🆕
Microsoft.Entra.DirectoryManagement: 1.0.13 → 1.1.0 🆕
Microsoft.Entra.Governance: 1.0.13 → 1.1.0 🆕
Microsoft.Entra.Groups: 1.0.13 → 1.1.0 🆕
Microsoft.Entra.Reports: 1.0.13 → 1.1.0 🆕
Microsoft.Entra.SignIns: 1.0.13 → 1.1.0 🆕
Microsoft.Entra.Users: 1.0.13 → 1.1.0 🆕
Found 10 modules with updates available.
>> $Modules | Update-PSResource

$dcgpofix documentation: Recreates the default Group Policy Objects (GPOs) for a domain. To get to the Group Policy Management Console (GPMC), you must install Group Policy Management as a feature through Server Manager. Dcgpofix.exe is included with Windows Server and is located in the C:\Windows\system32\ folder. dcgpofix.exe restores only the policy settings that are contained in the Default Domain Policy GPO and Default Domain Controller GPO. Dcgpofix.exe doesn't restore other GPOs that administrators create, it's only intended for disaster recovery of the default GPOs. Important: As a best practice, you should configure the Default Domain Policy GPO only to manage the default Account Policies settings, Password Policy, Account Lockout Policy, and Kerberos Policy. Additionally, you should configure the Default Domain Controllers Policy GPO only to set user rights and audit policies.$

A screen shot from Microsoft learn documentation that states:

Caution

Certutil isn't recommended to be used in any production code and doesn't provide any guarantees of live site support or application compatibilities. It's a tool utilized by developers and IT administrators to view certificate content information on devices.

Certutil.exe is a command-line program installed as part of Certificate Services. You can use certutil.exe to display certification authority (CA) configuration information, configure Certificate Services, and back up and restore CA components. The program also verifies certificates, key pairs, and certificate chains.

Windows Terminal running PowerShell 7.5.4 with Oh My Posh.

A bag of Brazillian coffee from Verb coffee roasters.

A note from GitHub copilot's review of my script:

🔧 Issues & Recommendations

1. Modified Date is Incorrect
The date shows October 16, 2025, but today is October 16, 2025. If this was recently modified, the year seems unusual (future date in the comment).

Screenshot of a GitHub notification about Microsoft.Graph SDK build 2.31.0 with two merged PRs:

Include users.onPremesisSync #3407
Include groups.onPremesisSync #3400

Windows Terminal warning: Unable to find the following fonts: RobotoMono Nerd Font Mono. Please either install them or choose different fonts.

From L to R: Sam Erde, Frank Lesniak, and Clayton Tyger; hanging out after dinner in Chicago.

A squirrel is wearing an apron and shaving a yak in a barber shop. A bike means in the corner and a yellow rubber ducky sits on the counter.

PowerShell> Find-PSResource Microsoft.Graph

A stressed pickle trying to explain their code problem to a rubber duck.

Update-PSResource -Name 'Microsoft.Entra'
# or
Install-PSResource -Name 'Microsoft.Entra'

A chat with Copilot for Microsoft 365:

Me: Please summarize the key items that I need to follow up on or be aware of from the past two weeks that I was on vacation.

Copilot: Welcome back! Here's a comprehensive summary of the key items you need to follow up on or be aware of from the past two weeks (June 16–July 1) while you were on vacation. This summary is based on 80 emails, 4894 chat messages, 35 meetings, and multiple files and transcripts reviewed across your projects and teams.

"We're back!" (Even though there's only one of me.)

PowerShell
> Update-Module Microsoft.Entra

Question: "Odd question, but I know you have been focused on 7.x releases, but has there been any talk about an 8.0 release?"

Answer from Steve Lee: "Our current plan is to never have a 8.0 release as we're following semver unless we must have some big breaking change. A 8.0 release effectively means splitting the PS Community again between 5.1, 7.x, and 8"

UPN prefix and suffix changes
We recommend you change user UPN when their primary email address changes. During initial synchronization from Active Directory to Microsoft Entra ID, ensure user emails and UPNs are identical. See the following example prefix and suffix changes.

$User = Get-ADUser -Identity $env:USERNAME -Properties CN

$CN = [regex]::Escape("$($User.CN)")
$OU = ($User.DistinguishedName).TrimStart("CN=$CN,")
# or combine the two lines and create one less variable:
$OU = ($User.DistinguishedName).TrimStart("CN=$([regex]::Escape($User.CN)),")

Write-Output "Organizational Unit: $OU"

$$NonInteractive = if ( (-not [Environment]::UserInteractive) -or ([Environment]::GetCommandLineArgs() -match 'NonInteractive') -or ($env:GITHUB_ACTIONS -eq 'true') -or ($env:GITLAB_CI -eq 'true') ) { $true }$

$Blocking permissions on the PowerShell\Modules\Microsoft.Graph.Authentication\2.26.1 folder to try to prevent it from being updated to this version.$