PowerShell script to extract M365 security data for your own AI analysis

blog

I wrote about how I have now integrated PowerShell and AI recently:

https://blog.ciaops.com/2026/01/22/combining-powershell-and-ai-for-m365-security-analysis/

In that example, I use my own agent developed in Azure AI Foundry to analyse security data extracted from Microsoft 365. In there I did offer free access to the script and my Foundry AI agent for analysis. However, I do appreciate that many people are hesitant to allow a ‘foreign’ AI system to evaluate private M365 security data.

Therefore, I have created another script that will simply extract your M365 security data and put it into a local JSON file that you can then upload to your own AI for analysis. You will find that script at:

https://github.com/directorcia/Office365/blob/master/Analysis/Secure%20Score/o365-secure-score-extract.ps1

and the documentation is here:

https://github.com/directorcia/Office365/wiki/Extract-Microsoft-365-Secure-Score-information

To use this script you need to have the PowerShell Graph module installed and use an account that has appropriate access to M365 security information.

Screenshot 2026-01-23 074402

When run, you’ll see it extract the security from various places in the tenant as shown above.

Screenshot 2026-01-23 074545

It will then save that information to a local file as shown above.

Screenshot 2026-01-23 074702

In this case you’ll see that I used the –compact option to two data files. The normal one, which is around 8MB and a smaller one around 234KB. The reason for this is that I found in my testing that many AI systems don’t support large file uploads (M365 Copilot does but). So the smaller one can work with those limited systems.

Once you give your AI system of choice access to the data file by uploading it, you can then use any prompt you wish to analyse the data. Here are some prompts I have created you can use. A long one:

https://github.com/directorcia/Office365/blob/master/Analysis/Secure%20Score/prompt-long.txt

and a shorter one:

https://github.com/directorcia/Office365/blob/master/Analysis/Secure%20Score/prompt-short.txt

I have uploaded my test data into a variety of AI systems but have gotten the best results from M365 Copilot Researcher and Analyst:

Screenshot 2026-01-23 075229

Screenshot 2026-01-23 080158

My original script does the extraction and the uploading for you together, but this new script now allows you to do just the extraction and then take that data and use any AI system or prompt you wish.

I have also created a number of additional scripts that extract as well as analyse a variety of other M365 services such as Exchange, SharePoint Entra Id and more. These are available to CIAOPS Patrons.

If you find a great prompt to use with this extracted data, let me know and I’ll share it so everyone can benefit.

Combining PowerShell and AI for M365 Security Analysis

powershell_ai_m365_security_no_text

I’ve used AI to create smart Microsoft 365 expert technical agents which I have deployed to Teams for CIAOPS Patrons:

image

I’ve also created a smart Microsoft 365 expert technical agent that you can use for free via email:

https://blog.ciaops.com/2025/06/11/get-your-m365-questions-answered-via-email-2/

simply by putting your question in the body of an email and sending it to robert.agent@ciaops365.com.

Now, I have integrated AI into my PowerShell scripts! Let me explain what I’ve done.

I’ve created an agent in Azure AI Foundry that is ‘grounded’ with all my M365 knowledge that is in the CIAOPS Patron community. I’ll cover off what I have learned about Azure AI Foundry in another post.

Next, I created a PowerShell script that firstly logs into a tenant to be inspected,

image

extracts all the security information like Secure Score details, Conditional Access policies and more,

image

bundles all that up into a single JSON file (about 8MB in size)

image

and then connects to my Foundry agent and uploads that extracted data for analysis

image

After analysis it generates and displays an extensive HTML report

image

which looks like:

image

and you can find a complete copy of to review at here, because it is too large for this post:

https://github.com/directorcia/Office365/blob/master/Analysis/secure-score-foundry.png

image

I’ve configured my Foundry agent to use a ‘Model router’, meaning that the agent uses what it things is the best LLM to do the analysis automatically.

The report include Prioritized recommendations:

image

A visualized Remediation Roadmap:

image

and whole lot more. I encourage you to take a moment and study the example output for yourself, which is AI generated.

I am now building similar AI analysis scripts for al M365 services like Exchange, SharePoint, etc and plant expand these over time.

Here’s the best part. As part of my testing process I am happy to make this Secure Score AI Analysis script available to a select few who read this and send me an email (director@ciaops.com) asking for a copy. You’ll need to be comfortable with PowerShell and have the MSGraph module already installed to run the script. Even better for the select few that do respond – I’ll give you access to my Azure AI Foundry agent for FREE to do the analysis. There are some conditions you’ll need to agree to, like going on my email list and understanding this is all still a beta test but there will be no cost if you qualify and agree. To start that process just email me (director@ciaops.com) saying you are keen to give it a go and I’ll send along the all the details.

There are just so many ways that I can see how to integrate AI with PowerShell and I’ll be sharing more soon on what I am doing.

New publication–Ongoing AI support & Optimization Playbook for MSPs

ongoing-cover-330

https://directorcia.gumroad.com/l/aisupportmsp

Ongoing AI Support & Optimization Playbook (Managed AI  Services for SMB MSPs)

Introducing the Ongoing AI Support & Optimization Playbook – your ultimate guide to mastering managed AI services for SMB MSPs! This comprehensive playbook is designed to empower Managed Service Providers (MSPs) with the knowledge and tools needed to deliver continuous AI support and optimization after deploying Microsoft 365 Copilot.

Why Read This Playbook?
  1. Step-by-Step Guidance: This playbook offers a detailed, step-by-step guide for MSPs to ensure that AI solutions remain effective and aligned with client needs. It covers everything from technical operations to business practices, making it an invaluable resource for maintaining and enhancing AI capabilities.

  2. Proactive Maintenance: Learn how to proactively monitor and improve AI solutions. The playbook provides insights on leveraging Microsoft’s admin tools to track user interactions, measure impact, and gather feedback. This ensures that AI tools like Copilot are always optimized and delivering value.

  3. Business Value Delivery: Discover how to position yourself as a long-term AI partner for your clients. The playbook emphasizes the importance of engaging with stakeholders, demonstrating value, and identifying growth opportunities. This approach helps MSPs build strong, lasting relationships with their clients.

  4. Packaging and Pricing: Get practical advice on how to package, price, and integrate AI services into your existing offerings. The playbook includes best practices for defining service scope, setting clear expectations, and choosing the right pricing model to ensure profitability.

  5. Real-World Examples: Benefit from real-world examples and case studies that illustrate the successful implementation of AI support and optimization strategies. These examples provide valuable insights and inspiration for applying the playbook’s principles in your own business.

Key Benefits
  • Continuous Optimization: Ensure that AI tools like Microsoft 365 Copilot remain effective and up-to-date, providing ongoing value to your clients.

  • Enhanced Client Relationships: Position yourself as a strategic AI partner, not just a technician, by delivering continuous improvement and innovation.

  • Increased Revenue: Identify upsell and expansion opportunities to grow your recurring revenue through managed AI services.

  • Comprehensive Support: Offer a clear support channel for AI-related issues, ensuring that your clients receive timely and effective assistance.

The Ongoing AI Support & Optimization Playbook is a must-read for any MSP looking to excel in the rapidly evolving AI landscape. By following the guidance provided, you can transform a one-time AI deployment into a long-term, profitable service that continuously delivers value to your clients 1.

Don’t miss out on this essential resource – get your copy today and take your AI support services to the next level!

Now included with MSP AI Playbook bundle – https://directorcia.gumroad.com/l/mspaipb

See all the titles available at – https://directorcia.gumroad.com/

CIA Brief 20260118

image

Demystifying Exchange Online Mailbox Quotas –

https://techcommunity.microsoft.com/blog/exchange/demystifying-exchange-online-mailbox-quotas/44864…

Inside RedVDS: How a single virtual desktop provider fueled worldwide cybercriminal operations –

https://www.microsoft.com/en-us/security/blog/2026/01/14/inside-redvds-how-a-single-virtual-desktop-provider-fueled-worldwide-cybercriminal-operations/

Turn Complexity into Clarity: Introducing the New UEBA Behaviors Layer in Microsoft Sentinel –

https://techcommunity.microsoft.com/blog/microsoftsentinelblog/turn-complexity-into-clarity-introdu…

After hours

The AI coding boom hits software – https://www.youtube.com/watch?v=FkmuyUTZvXU

Editorial

If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

An example of Level 1 tech support with Copilot

A while ago I did a video of using AI for tech support. You can find that here:

https://www.youtube.com/watch?v=Q3Y-8AzE2bw 

The major component that enabled this was ‘computer vision’ i.e. the ability of Ai to see the screen. Here is another personal example of using ‘AI vision’ to solve technical issues.

Upon returning late to my home office I found I had no internet. Damm! ISP failure I thought. I did the basics and reset my modem and then resigned myself to waiting until the ISP brought things back online.

I was a bit concerned about the connectivity because after about 30 minutes it hadn’t come back up. Unusual, I thought. After tethering my phone to allow temporary Internet access I check my UniFi console which showed me my home office had been offline for many hours. Now that was very, very unusual and indicated that the problem was more about my equipment than a fault with the ISP. So I started doing some more rigorous testing.

After getting down under my desk and cleaning all the dusk away I discovered my Ubiquiti USG (firewall/security) device didn’t seem to be working correctly. I powered it off and on, but now joy. I also noticed a regular soft ‘chirping’ noise and the console port was flashing.

A dead USG would be a major pain because I had to present my Copilot Flight School via Teams the following day.

My USG device has been superseded so I used Copilot to find me a suitable replacement model. I then check the unit on Amazon to see how quickly it could be delivered. The replacement is here:

https://www.amazon.com.au/Ubiquiti-UniFi-Cloud-Gateway-Ultra/dp/B0D8PSW2BZ/

delivery would be in about a week to my door. Handy, but not enough to save my bacon for tomorrow’s training.

I then went back to Copilot with the symptoms and this is what it told me:

A flashing light on the Console port of a Ubiquiti USG is a classic “cry for help” from the hardware. It almost always points to a specific hardware failure rather than a software crash.

In most cases, it does not mean the main chip is dead, but it does mean the gateway cannot boot. Here is what that flashing light typically signifies:

1. The Power Supply Failure (90% of cases)

The most common cause of a flashing console light is a failing power brick. The capacitors inside the small black power adapter often wear out after 3–5 years. They can still provide enough power to blink an LED, but not enough “juice” to actually boot the internal processor.

The Symptom: You might also hear a very faint “chirping” or “clicking” sound coming from the USG or the power brick itself, synchronized with the flashing light.

The Fix: Find any 12V DC power adapter (at least 1.0A or higher, like 2.0A) with the same barrel plug size. Many people find that an old external hard drive or router power brick fixes the USG instantly.

Ok, so the power supply on the USG device has failed. It also have me this video of pretty much exactly the same issue i was having as confirmation to me that it was the same problem and what was needed to fix it!

https://youtu.be/toOxcrW9XzA

Luckily, right next to the USG device I had an very old USB hard disk, with an external power supply, that looked like it could do the job.

I look the above photo, provided it to Copilot and asked whether this woulr work with the USG. Here is what I got back:

Yes, that power adapter is perfectly suitable for your Ubiquiti USG.

Based on the photo you provided, the specifications match exactly what the USG needs to function correctly—and it may even be better than the original.

Why this adapter is a good match:

Voltage (12V): It matches the USG’s required 12V DC exactly.

Amperage (1.5A): The original USG power brick was only 1.0A. This 1.5A adapter provides more “room” for the device to draw power, which often prevents the common power-failure issues seen with the original bricks.

Polarity (Center Positive): The diagram on the label (the line pointing to the center of the circle with a +) matches the center-positive requirement of the USG.

Plug Type: This appears to be a standard 5.5mm x 2.1mm barrel jack, which is the correct physical fit for the USG power port.

How to test it:

Unplug your old power adapter from the USG.

Plug this “Von” adapter into the wall and then into the USG.

Watch the lights: If the power supply was the problem, the console light should stop flashing, and the main square light on top of the USG should eventually turn solid white (booting) or solid blue (connected).

Safety Note: While this adapter is electrically compatible, always ensure it remains in a well-ventilated area, as these smaller “wall wart” adapters can get warm during constant use.

Would you like me to walk you through what to do if the lights still don’t turn solid after swapping the power brick?

It was able to read and verify the specifications of this power supply, based on my photo, and check to see whether it would be suitable and guess what? It was! I used this power supply and my USG can right back up and my Internet was restored. Amazing! All of this at 11pm at night without the need to buy and ship or replacement or talking to anyone!



I also saw the above image floating around my socials and thought that it was interesting to see the impact that Ai is having on technical forums like Stack Overflow and probably every other technical forum out there. My own experience, with all the forums I work with mirrors this, AI is changing the game for anything that relies on expertise. As the Internet democratised and commoditise communication so AI will do the same for expertise it seems!

We now live in a world where I can use AI at anytime of the day, give it a photo of my issue and have it solve it for me with to your delivery by Amazon of any replacement equipment required. Let’s hope your business doesn’t depend on things that have already been superseded!

Flight School: Mastering Copilot for IT Pros–On demand

image

My 10 hour virtual training is now available on demand from:

https://directorcia.gumroad.com/l/mccpitpro

Turn Microsoft Copilot from “nice to have” into a practical, revenue‑driving capability. Flight School: Mastering Copilot for IT Pros is an immersive, live online program designed for IT professionals and MSPs, delivered over a focused cohort so you get hands‑on practice, real examples, and repeatable patterns you can apply the same day. It runs as a multi‑day virtual training specifically crafted for IT Pros and Managed Service Providers, with a strong emphasis on practical usage and adoption in Microsoft 365 environments.

What sets this course apart: every session is built around real Microsoft 365 tenant scenarios—security, governance, AI agent workflows, and user adoption—so you leave with a simple, repeatable framework, not just theory.


Who this course is for

  • IT administrators, solution architects, and consultants rolling out Copilot across Microsoft 365 tenants.

  • MSP owners and engineers building Copilot-powered offerings for SMB customers.

  • Technology leaders responsible for security, compliance, and change management in Microsoft 365.


What you’ll learn (outcomes)

By the end of Flight School you will be able to:

  • Explain the practical AI stack for Microsoft 365—data → security → search → identity/licensing → Copilot/agents—and use it to make sound, risk‑aware implementation decisions.

  • Harden your tenant for AI by aligning service‑level and item‑level security, data labelling, and DLP so Copilot respects access boundaries.

  • Use Copilot Chat effectively (history, memory, attaching files from OneDrive/SharePoint) and apply prompt books and prompt engineering techniques that non‑technical users can follow.

  • Leverage advanced Copilot agents (Researcher, Analyst), Notebooks, Admin Copilot, and SharePoint/Channel agents to automate research, reporting, and routine admin work.

  • Design an adoption plan for SMB tenants: licensing choices, enablement, tips for Teams/Outlook/SharePoint usage, and how to package Copilot services in an MSP offering.


Course format & inclusions

  • Instructor‑led online cohort (multi‑day) with focused, practical sessions.

  • Session recordings and downloadable resources so you never miss a step.

  • Hands‑on demonstrations using Microsoft 365 tenants, showing exactly how to configure, test, and measure results.

  • Recommended setup: a Microsoft 365 Copilot–enabled tenant is ideal to follow along with internal data scenarios (emails, files, Teams, SharePoint).


Program snapshot (sample sessions)

  • Session 1 – The AI Stack for Microsoft 365
    Foundations of the AI stack, security posture, governance, search, licensing, identity, and how Copilot fits.

  • Session 2 – Copilot Chat, Memory & Prompt Books
    Practical workflows, attaching tenant data, creating re‑usable prompt books, and using Loop for collaborative artefacts.

  • Session 3 – Security, Compliance & Internal Data
    Item‑level protection, data labelling, DLP, safe access to internal content, and when to choose paid Copilot capabilities.

  • Session 4 – Notebooks & Agents
    Researcher and Analyst agents, Admin Copilot, SharePoint and Channel agents in Teams, and automation patterns you can adopt immediately.

Cohorts are delivered as a structured multi‑day virtual training for IT Professionals and MSPs—clear, practical, and built for real‑world use.


Why learn with CIAOPS

Flight School sessions are delivered by Robert Crane, a long‑time Microsoft 365 educator and the principal behind CIAOPS, who routinely leads live community sessions and training across Microsoft 365 and Copilot.

Some feedback received so far from attendees:

I’ve just completed a five‑day Copilot course, and I can honestly say it has been a game‑changer for the way I work. Over the week, Rob shared an incredible range of practical tools, tips, and resources that will not only help me boost productivity but also streamline my daily tasks with best‑practice approaches.
What impressed me most was how immediately applicable everything was. I’m already seeing how these new skills will dramatically reduce the amount of time I spend sitting in front of a computer entering data—freeing me up to focus on higher‑value work. The sessions were clear, insightful, and genuinely empowering.
A huge thank you to Rob for delivering such a valuable and engaging program. I’d highly recommend this course to anyone looking to work smarter, not harder.

Rob’s training is well worth the investment not only from a $ perspective, but from the time invested. Over the course of 5 days I’ve been able to glean a huge amount of things that I “thought I knew” and use them better. Can’t wait to review the recordings to see what else I can do. Thanks Rob.

New publication–Copilot Deployment Playbook for MSPs

blog

https://directorcia.gumroad.com/l/mspdeplotpb

Copilot Deployment Playbook for SMB Clients – MSP Guide

Introducing the Deployment Playbook for SMB Clients – your ultimate guide to successfully rolling out Microsoft 365 Copilot for small and medium-sized businesses. This comprehensive playbook is designed specifically for Managed Service Providers (MSPs) and IT professionals, offering a step-by-step approach to ensure a seamless and effective deployment.

Why You Need This Playbook:
  • Expert Guidance: Navigate the complexities of deploying Microsoft 365 Copilot with ease. Our playbook provides detailed instructions on licensing, technical setup, data preparation, user onboarding, and post-pilot evaluation

  • Maximize ROI: Learn how to demonstrate tangible value with a small-scale Copilot deployment, ensuring your clients see the benefits and are ready for a broader rollout

  • Security and Compliance: Ensure that Copilot respects existing Microsoft 365 policies and data access controls, protecting sensitive information while delivering value

  • User Training and Support: Equip your clients with the knowledge and tools they need to make the most of Copilot, from pilot user training to measuring success

Key Features:
  • Licensing Procurement & Setup: Ensure your clients have the correct licenses and understand the costs and commitments involved

  • Tenant Configuration: Enable and configure all required tenant settings so that Copilot can function correctly and securely within the client’s Microsoft 365 environment

  • Grounding Data Preparation: Load and organize the client’s content and knowledge to ensure meaningful, organization-specific answers from Copilot

  • Pilot Group Selection & Onboarding: Choose a small, representative group of users to participate in the pilot, assign them the Copilot licenses, and ensure they have everything needed to start using Copilot

  • Pilot Execution: Monitor, support, and iterate during the pilot run to ensure engagement and gather insights on how Copilot is being used

  • Evaluation & Reporting: Conclude the pilot with a comprehensive evaluation of results and prepare a pilot report that summarizes usage, user feedback, and the value achieved

Benefits:
  • Increase Efficiency: Help your clients streamline their workflows and improve productivity with Microsoft 365 Copilot.

  • Enhance Customer Engagement: Provide your clients with the tools they need to better manage customer interactions and improve their digital presence.

  • Stay Ahead of the Curve: Position yourself as a forward-thinking MSP by offering cutting-edge AI solutions to your clients.

Don’t miss out on the opportunity to elevate your services and deliver exceptional value to your clients. Purchase the Deployment Playbook for SMB Clients today and take the first step towards a successful Microsoft 365 Copilot deployment.

See all the titles available at – https://directorcia.gumroad.com/

CIA Brief 20260112

image

Microsoft OneDrive, a year in review: AI-powered file management and smarter collaboration –

https://techcommunity.microsoft.com/blog/microsoft365insiderblog/microsoft-onedrive-a-year-in-revie…

Add links to text faster in Word –

https://techcommunity.microsoft.com/blog/microsoft365insiderblog/add-links-to-text-faster-in-word/4…

Determine Defender for Endpoint offboarding state of Windows machines using PowerShell –

https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/determine-defender-for-e…

From awareness to action: Building a security-first culture for the agentic AI era –

https://www.microsoft.com/en-us/microsoft-cloud/blog/2025/12/10/from-awareness-to-action-building-a…

Always‑on Diagnostics for Purview Endpoint DLP: Effortless, Zero‑Friction troubleshooting for admins –

https://techcommunity.microsoft.com/blog/microsoft-security-blog/always%E2%80%91on-diagnostics-for-…

Explore the latest Microsoft Incident Response proactive services for enhanced resilience –

https://www.microsoft.com/en-us/security/blog/2026/01/07/explore-the-latest-microsoft-incident-resp…

Exchange Online canceling the Mailbox External Recipient Rate Limit –

https://techcommunity.microsoft.com/blog/exchange/exchange-online-canceling-the-mailbox-external-re…

Introducing the Microsoft Defender Experts Suite: Elevate your security with expert-led services –

https://www.microsoft.com/en-us/security/blog/2026/01/06/introducing-the-microsoft-defender-experts…

Phishing actors exploit complex routing and misconfigurations to spoof domains –

https://www.microsoft.com/en-us/security/blog/2026/01/06/phishing-actors-exploit-complex-routing-an…

Announcing public preview: Uncovering hidden threats with the Dynamic Threat Detection Agent –

https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/announcing-public-preview-un…

After hours

Dawn of Cyberwarfare | Full Award-Winning Documentary – https://www.youtube.com/watch?v=BIEOB2jIr_o

Editorial

If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week