MSOnline and AzureAD PowerShell Module Replacement – What You Need to Know

This article provides a comprehensive guide for IT Pros on why Microsoft is replacing the MSOnline and AzureAD PowerShell modules, and what it means for their current PowerShell scripts, and how best to migrate to the new modules.

Microsoft announced the retirement and deprecation of the MSOnline and AzureAD PowerShell modules back in the middle of 2022. Originally, they set a date for retirement of March 30, 2024. However, because this retirement is a major shift in how IT professionals manage Microsoft Entra ID (formerly Azure Active Directory) and related services, it was pushed back.

These legacy PowerShell modules are being replaced with newer Microsoft Graph SDK and Microsoft Entra modules (currently in preview), which offer modern, cloud-focused features and functions.

The replacement of MSOnline and AzureAD PowerShell modules

As early as 2021, Microsoft announced their plans to invest in Microsoft Graph PowerShell SDK as the ‘PowerShell provider’ for Microsoft Entra and transition away from AzureAD and MSOnline Powershell modules.

In 2022, they announced the deprecation of AzureAD and MSOnline modules would occur on March 30, 2024. (Yes, we’re closing in on one year already…) They’ve made consistent progress on parity gaps between the old and the new.

When is Microsoft deprecating the modules? An overall timeline

Here are the key dates of retirement for the existing modules.

Module	End of support	Temporary outage tests	Retirement
MSOnline	March 30, 2025	Between January 20, 2025, and March 30, 2025	Early Apr 2025 to late May 2025
AzureAD	March 30, 2025	N/A	After July 1, 2025

So, the most important column above is ‘Retirement.’ This is literally when you can expect the legacy PowerShell modules to stop working, period. Starting in the first week of April 2025, tenants will notice the two legacy modules either do not work or generate an error. And yes, individual customers are NOT being given any warning.

Temporary outages have already begun

Organizations have already reported that they’ve been affected by the temporary outages Microsoft announced above. Microsoft has initiated approximate 8-hour outage blocks on various tenants across the globe.

As of March 2025, they report these temporary outages are complete. Companies can expect two more outages between now and March 26th.

Why are these PowerShell modules being retired?

Security is the primary driving force for the retirement and consolidation of these legacy modules. Because the AzureAD and MSOnline PowerShell modules are many years old, Microsoft engineers have built newer modules from the ground up.

The Microsoft Graph SDK PowerShell module is very much their pride and joy. If it was up to them, everyone would use this module exclusively.

The retirement of the MSOnline PowerShell module will begin the first week of April 2025. The module will stop working for ALL tenants by late May 2025.

The deprecation notice period for the AzureAD Powershell module ends on March 30, 2025. After this date, there will be no further maintenance or support. Microsoft is targeting the third (calendar) quarter of 2025 for the retirement of the AzureAD Powershell module.

Special Note – If you are using Microsoft Entra Connect Sync to sync your Active Directory (AD) domain(s) to Entra ID, you should make sure you’ve upgraded to the latest version by April 7, 2025. Any version older than 2.4.18.0 will NOT work after this date!

What’s new – Microsoft Graph SDK and Microsoft Entra PowerShell modules

As stated above, the newer, modern, and supported modules are the Microsoft Graph SDK Powershell and the Microsoft Entra modules. Microsoft lists many advantages of these newer modules over their predecessors. Here are some examples.

• Access to all Microsoft Graph APIs: Microsoft Graph PowerShell is based on Microsoft Graph API. The Microsoft Graph API includes, in addition to Microsoft Entra ID, APIs from other Microsoft services like SharePoint, Exchange, and Outlook, all accessed through a single endpoint with a single access token.
  
• Supports PowerShell 7: Microsoft Graph PowerShell module works with PowerShell 7 and later. It’s also compatible with Windows PowerShell 5.1.
  
• Cross-platform support: The Microsoft Graph PowerShell module works on all platforms including Windows, macOS, and Linux.
  
• Supports modern authentication: Microsoft Graph PowerShell supports the Microsoft Authentication Library (MSAL) which offers more security. For example, you can use Passwordless sign-in experiences.
  
• Supports external identities: Users from other Microsoft Entra tenants can authenticate to services in your tenant with Microsoft Graph PowerShell.

Link to install the Microsoft Graph PowerShell SDK

You can learn how to install and update the Microsoft Graph PowerShell SDK module on Microsoft’s website.

Link to install the Microsoft Entra PowerShell module

Also you can learn more about the newly released Microsoft Entra PowerShell module and the module installation procedures on Microsoft’s site.

How can I modify my existing PowerShell scripts for this migration?

If you’re asking yourself about your existing scripts and how they will or will not function after this retirement, you’re not alone. This is a hot topic amongst IT Pros. To give you a quick, oversimplified answer – No, scripts written in AzureAD (and MSOnline) won’t automatically work with Microsoft Graph SDK PowerShell.

The new cmdlet names have been designed to be easy to learn… according to Microsoft. Instead of using AzureAD or AzureADMS in cmdlet names, use Mg.

There are a few critical pillars you’ll want to address, depending on your organization and how many scripts you currently use. Let’s start with planning how to migrate your scripts.

Planning the criticality of your scripts

Here are some criteria you should use to document your existing scripts. Here are some sample points.

• Purpose: What is the main function of the script?
• Location: How are you storing and securing the script? Where is it executed from?
• Frequency of execution: How frequently is the script run and from what platform?
• Importance: What’s the business criticality of the script?
• Length: How long is the script?
• Cmdlets used and number of calls: A list of all cmdlets used and the frequency of your calls to them.
• Still required: Can you use existing or new product functionality to do what the script does to achieve the same results?
• Improvement points: Can you improve the script? For example, filter to the left of the pipeline, use modern authentication or use the PSScriptAnalyzer module.

Give your existing scripts an overall score. Arbitrarily choose a score system for your environment to help you prioritize what scripts should be re-written and which should be migrated.

You’ll almost certainly come across scripts that will work with changing, as an example, every reference of the PowerShell command ‘Set-AzureADUser’ to ‘SetMgUser’. But, not all of them will be that easy.

Benefits of Microsoft Entra module with your existing scripts

There is some really helpful and good news on this article’s subject – Microsoft Entra PowerShell is over 98% compatible with the Azure AD PowerShell module and over 80% parity with MSOnline cmdlets. By using the Enable-EntraAzureADAlias command, you only need to update one or two lines in your existing scripts, making migration to Microsoft Entra PowerShell quick and effortless.

Learn how to migrate from the legacy modules to Microsoft Entra PowerShell on Microsoft’s site.

Map of PowerShell cmdlets from MSOnline and AzureAD to Graph SDK

Because this is a high-impact change, Microsoft has produced documentation on mapping the old cmdlets to the Microsoft Graph SDK.

Here are some examples:

Azure AD cmdlet	Microsoft Graph PowerShell cmdlet
Connect-AzureAD	Connect-MgGraph
Disconnect-AzureAD	Disconnect-MgGraph

Azure AD cmdlet	Microsoft Graph PowerShell cmdlet
Confirm-AzureADDomain	Confirm-MgDomain
Get-AzureADDomain	Get-MgDomain
Get-AzureADDomainNameReference	Get-MgDomainNameReference
Get-AzureADDomainServiceConfigurationRecord	Get-MgDomainServiceConfigurationRecord
Get-AzureADDomainVerificationDnsRecord	Get-MgDomainVerificationDnsRecord
New-AzureADDomain	New-MgDomain
Remove-AzureADDomain	Remove-MgDomain
Set-AzureADDomain	Update-MgDomain

How to determine recent usage of legacy cmdlets

On the Microsoft Entra Admin Center website, there is a section that assists you in reporting recent activity by engineers using the legacy PowerShell modules. You can then communicate with your engineers about this migration process and how to complete it efficiently.

• On the Microsoft Entra Admin Center website, browse to Identity -> Overview
• Then click the ‘Recommendations‘ tab.

• You can click the ‘More details‘ link for each module to get some more details.

Engage a third-party vendor solution

If your environment is complex and/or this is the first you’re hearing of this retirement (you should be watching the Microsoft 365 Admin Center Message Center!), you may want to engage a third-party to help you with the heavy lifting like Cayosoft Administrator. Using an off-the-shelf tool reduces the risks associated with relying on complex scripts to automate and manage tasks in your environment.

Thank you for reading my post on the retirement of AzureAD and MSOnline PowerShell modules. Feel free to leave a question or comment below.