What it works with
Module: Microsoft.Graph.Authentication
Context: PowerShell 7 · Microsoft Graph · Microsoft Entra
Compatibility: PowerShell 7 is the supported target for this Microsoft 365 template.
POWERSHELL / ENTRA
Pro PreviewAdvancedRead-onlylow
Export Entra Administrative Units and scoped role assignments
Exports Microsoft Entra Administrative Units and directory role assignments scoped to those units for delegated-administration review.
PRO PREVIEW · Generation after access validation · Review before running · No tenant access
What this PowerShell script does
Exports Microsoft Entra Administrative Units and directory role assignments scoped to those units for delegated-administration review.
Requirements
- CSV output path - Use a new absolute Windows CSV path, for example C:\Temp\opselith-report.csv.
Environment
- Module: Microsoft.Graph.Authentication
- Permissions: AdministrativeUnit.Read.All and RoleManagement.Read.Directory delegated Microsoft Graph permissions.
- Output: CSV report
- Context: PowerShell 7 · Microsoft Graph · Microsoft Entra
- Risk: Low
Review before you run The template is read-only, but you should still review its scopes, target environment and output before execution.
OPS / WORKSPACE
Ready to generate
Configure Export Entra Administrative Units and scoped role assignments in the Builder, review the generated PowerShell and run it in your own environment.
Why use this template?
Exports Microsoft Entra Administrative Units and directory role assignments scoped to those units for delegated-administration review. It is designed as a focused inventory step that you can review and retain locally.
The template uses Microsoft.Graph.Authentication and requires AdministrativeUnit.Read.All and RoleManagement.Read.Directory delegated Microsoft Graph permissions.. Output: CSV report.
Review before running
Read the generated script before execution. Read-only describes the intended Opselith template behavior; your surrounding commands, environment and permissions remain your responsibility.
This is a Pro Preview template. Pro is not publicly for sale yet; existing authorized access can generate the script after server-side entitlement validation.
Generate the script
- Open the template in the PowerShell Builder.
- Enter the requested values and review modules, permissions, output and risk.
- Generate, inspect and save the script before running it in your own administration environment.
OPS / SCRIPT DETAILS
Script details
Exports Microsoft Entra Administrative Units and directory role assignments scoped to those units for delegated-administration review. Review these details before generating or running the script.
Permissions and impact
Permissions: AdministrativeUnit.Read.All · RoleManagement.Read.Directory
Risk: Low
Execution impact: Read-only. The script reads configuration or inventory data and does not intentionally create, update or remove objects.
Parameters
- CSV output path - Use a new absolute Windows CSV path, for example C:\Temp\opselith-report.csv.
Output
Output: CSV report generated locally by the script.
This template is part of the Pro library. The full Pro script is generated by Opselith after server-side license validation; only the configuration values needed by this template are sent for generation. No tenant connection is required. When you generate a Pro script, only the configuration values needed for that template are sent to Opselith after license validation.
Example use
Exports Microsoft Entra Administrative Units and directory role assignments scoped to those units for delegated-administration review.
Enter the required values in the Builder, review the generated script and confirm the output before running it.
Before you run: Confirm the required AdministrativeUnit.Read.All and RoleManagement.Read.Directory delegated Microsoft Graph permissions.. Review the generated script and output path, then run it from the documented administrator PowerShell environment.
ValidationRecorded evidenceQA reviewed
Static QAPassed
PSScriptAnalyzerPending
Runtime testedNot yet recorded
Last validatedNot yet recorded
Runtime and community evidence change only after an external tester result is reviewed and accepted for release evidence.
Tester: report a result →TRUST / EVIDENCERecorded trust facts
Last reviewed: 27 Aug 2026
Analyzer evidence: Awaiting a release PSScriptAnalyzer gate that includes this script. No analyzer pass is claimed yet.
Pending and Not yet recorded are evidence states, not failures. Analyzer status does not imply runtime validation.
Was this useful?One click. No email.