Migrating from Connect-AzureAD to Connect-MgGraph

As Microsoft phases out the AzureAD module in favor of the Microsoft Graph PowerShell SDK, one of the most fundamental shifts for administrators is replacing Connect-AzureAD with Connect-MgGraph. This change is more than just a new cmdlet — it reflects Microsoft’s broader shift toward a unified and secure Graph-based platform for managing Microsoft 365.

In this guide, we’ll explore what you used to do with Connect-AzureAD, how you should connect now using Connect-MgGraph, and what’s different between the two.

What You Did Previously with Connect-AzureAD

To begin working with the AzureAD module, admins used the following command:

Connect-AzureAD

This launched an interactive sign-in window and authenticated the session. From there, you could manage users, groups, and directory objects using AzureAD-specific cmdlets.

✅ Simple? Yes.

❌ But it lacked permission granularity and modern security controls.

What You Should Do Now with Connect-MgGraph

The replacement is Connect-MgGraph, part of the Microsoft.Graph module. Unlike Connect-AzureAD, this cmdlet requires you to explicitly define the permissions (scopes) your session needs — aligning with modern security best practices.

First, Install Microsoft Graph PowerShell

Install-Module Microsoft.Graph -Scope CurrentUser

Use -Scope CurrentUser to avoid needing admin rights for installation.

Then, Connect Using Required Scopes

Connect-MgGraph -Scopes "User.Read.All"

This will prompt you to consent to the scope(s), providing only the required access — no more, no less.

Common Scopes You Can Use

Scope	Description
User.Read.All	Read all users
User.ReadWrite.All	Read and write all users
Group.Read.All	Read all groups
Group.ReadWrite.All	Read and write all groups

You can also connect with multiple scopes:

Connect-MgGraph -Scopes "User.Read.All", "Group.Read.All"

What’s Different with Connect-MgGraph?

Old (Connect-AzureAD)	New (Connect-MgGraph)
No scope declarations	Requires explicit -Scopes input
AzureAD-only context	Accesses entire Microsoft 365 Graph API
One-size-fits-all permissions	Consent-based, least privilege model
Deprecated and unmaintained	Fully supported, cross-service compatible
Part of AzureAD module	Part of Microsoft.Graph SDK

Conclusion

Moving from Connect-AzureAD to Connect-MgGraph is a key step toward a more secure, flexible, and future-ready Microsoft 365 management experience. While Connect-MgGraph requires an initial adjustment with scopes, it aligns perfectly with Microsoft’s Zero Trust and least privilege security models.

The new model may feel more structured, but it gives you greater control, accountability, and broader access to users, groups, mail, Teams, security, and beyond — all via Microsoft Graph.