I have worked in IT for about 20 years. A lot of that was MSP operations. Today I work as an M365 cloud admin.

Most tenants I have seen are still hybrid. Users live in on-prem Active Directory and sync to Entra ID. So the cloud is only as clean as AD.

I kept writing the same AD and sync checks. So I cleaned them up and shared them on GitHub. This toolkit uses PowerShell 7, the RSAT ActiveDirectory module, the ADSync module and Microsoft Graph.

Repo: active-directory-hybrid-powershell-toolkit

The problem it solves

Old accounts pile up in AD. Nobody is sure who is really in Domain Admins.

Sync breaks quietly. A duplicate email alias blocks one user, and you find out when they call.

These scripts make those checks quick and repeatable.

Highlight scripts

Get-ADStaleAccountReport.ps1

Finds enabled users and computers that have not logged on in a number of days. You can skip OUs like service accounts.

. / Get - ADStaleAccountReport .…