What it works with
Module: Microsoft.Graph.Authentication · Microsoft.Graph.Identity.DirectoryManagement
Context: PowerShell 7 · Microsoft Graph
Compatibility: PowerShell 7 with the current Microsoft Graph PowerShell SDK is recommended.
POWERSHELL / MIGRATION
FreeAdvancedRead-onlyLow
Export Microsoft 365 domain dependency report
Exports Microsoft Entra directory objects that reference a selected domain so administrators can identify dependencies before a domain move or tenant-to-tenant migration.
Free browser generation · Review before running · No tenant access by Opselith
What this PowerShell script does
Exports Microsoft Entra directory objects that reference a selected domain so administrators can identify dependencies before a domain move or tenant-to-tenant migration.
Requirements
- Domain to inspect - Enter an exact domain such as contoso.com, or * to inspect every domain in the tenant.
- CSV output path - Use a new absolute Windows CSV path.
Environment
- Module: Microsoft.Graph.Identity.DirectoryManagement
- Runtime: 7+
- Permissions: Domain.Read.All · Global Reader or Domain Name Administrator
- Risk: Low
Review before you runUse an account with Domain.Read.All and an appropriate read-only Entra role. Enter one exact domain or * for all domains and review the output before planning domain removal.
OPS / WORKSPACE
Ready to generate
Configure Export Microsoft 365 domain dependency report in the Builder, review the generated PowerShell and run it in your own environment.
When to use this template
Use this before moving or detaching a custom domain to identify Entra directory objects that Graph reports as referencing that domain.
Important limitations
- The domainNameReferences relationship identifies Microsoft Entra directory-object dependencies; it is not a complete scan of every external SaaS or on-premises dependency.
- Display names may be unavailable for object types the app cannot fully read; such rows remain identified by object ID and type.
Generate the script
- Open this template in the PowerShell Builder.
- Enter the required values and review the documented permissions and output.
- Generate the script, inspect it, then run it in your own PowerShell environment.
OPS / SCRIPT DETAILS
Script details
Exports Microsoft Entra directory objects that reference a selected domain so administrators can identify dependencies before a domain move or tenant-to-tenant migration. Review these details before generating or running the script.
Permissions and impact
Permissions: Domain.Read.All · Global Reader or Domain Name Administrator
Risk: Low
Execution impact: Read-only. Reads administrative data and does not intentionally change the target environment.
Parameters
- Domain to inspect - Enter an exact domain such as contoso.com, or * to inspect every domain in the tenant.
- CSV output path - Use a new absolute Windows CSV path.
Output
Output: CSV with Domain, IsVerified, IsDefault, IsInitial, SupportedServices, DependencyCountForDomain, ObjectId, ObjectType, DisplayOrIdentifier, ResolutionStatus, DependencyStatus, Status and Error.
This template is available in the free library and is generated locally in your browser.
Example use
Exports Microsoft Entra directory objects that reference a selected domain so administrators can identify dependencies before a domain move or tenant-to-tenant migration.
Enter the required values in the Builder, review the generated script and confirm the output before running it.
Before you run: Use an account with Domain.Read.All and an appropriate read-only Entra role. Enter one exact domain or * for all domains and review the output before planning domain removal.
Opselith quality checks
- Included in the current Opselith PowerShell quality suite
- Uses documented domainNameReferences relationship
- Domain.Read.All rather than broad Directory.Read.All by default
- Graph paging enabled
- Limited-information objects remain explicit
- No domain changes
Was this useful?One click. No email.