PowerShell for IT teams on Microsoft 365 and Active Directory
Let the help desk run the script. Keep the admin rights to yourself.
Stop being the bottleneck for every mailbox grant and password reset. PowerScripts turns your PowerShell into simple forms your help desk can run, so routine work leaves your queue and Global Admin stays with you. Start from 217 ready-to-run tasks, and every run is recorded down to the exact version of the code, so when audit asks “who did that?”, you already have the answer.
The real product: Harry on the help desk resets a password from search. The new password is never shown; he gets one Copy button. Watch the full demo (1:15)
In production
Scripts run on PowerScripts installs.
Lifetime total, reported by running installations.
See it work
Real runs, recorded on a real Microsoft 365 tenant and Active Directory.
Lakefront Works is our demo company. Every clip is the actual product, narrated, with captions. Start with the three-minute tour, or jump to your job.
Why teams buy it
Most IT shops already run on PowerShell. Few of them can see it.
The best script is on someone's desktop.
When that person is out, the task waits or someone rewrites it. PowerScripts keeps every script in one Git-backed library with history and diffs.
Junior staff get Exchange admin to add a delegate.
With PowerScripts the service account holds the rights. Your people get a form for the scripts you grant them, and nothing else.
Nobody knows who changed that mailbox.
Every run records who ran it, against what, with which inputs, the full output, and the Git commit of the code. Searchable, down to the output text.
How a run works
From request to result in five steps.
Find the object or the script.
One search box covers Microsoft 365 and Active Directory: users, mailboxes, groups, teams, sites and computers, looked up live. Right-click a result to see the scripts that apply to it.
Fill in the form.
Each parameter becomes a field: dropdowns for fixed choices, switches for on/off, live search for people and mailboxes.
Check readiness.
PowerScripts connects to the target and confirms every cmdlet the script needs is available, without running it.
Run and watch.
Output streams into the console as it happens. Each run gets its own PowerShell 7 process, cleaned up when it ends.
Rerun or reverse.
Repeat a run with the same inputs, or undo it. Scripts can declare their opposite and capture the prior state first.
A real catalog script. Click Run, then try Reverse. The parameters, cmdlets and undo prompt come from the script's own settings file.
The catalog
Scripts ready on day one.
The catalog is a Git repository that ships with PowerScripts. Use a script as it is, or fork it and make it yours. When we publish updates, you sync them in and your edited copies are left alone.
Access control
Grant the script, not the role.
Every person gets a role, and roles combine. Running a script also needs a grant, given to a person or to an Entra ID or Active Directory group. Scripts you haven't been granted don't appear at all, and only the people who maintain scripts ever see their code.
| Role | Who it's for | Run scripts | Run history | Script code, edit & fork | Schedules | Settings |
|---|---|---|---|---|---|---|
| Admin | Owns the install | Any script | Everyone's | ✓ | Any | All |
| Script Author | Writes and maintains scripts | Granted only | Everyone's | ✓ | Own | – |
| Script Operator | Help desk and service desk staff | Granted only | Their own | – | Own | – |
| Observer | Managers and auditors | Never | Everyone's | – | Read only | – |
| Configurator | Connections, credentials, preferences | – | Everyone's | – | Read only | Connections & preferences |
| User Manager | Accounts and script access | – | Everyone's | – | Read only | Users & grants |
Watch: roles decide who can do what (1:43) · HR runs starters and leavers, and nothing else (1:40)
Eleven built-in roles bundle scripts by area: Exchange Online, Entra ID, Compliance, Teams, SharePoint Online, Defender, Copilot, Active Directory, network and infrastructure, ERP and BI, plus a read-only reporting role that covers every area but only scripts that read. Denied attempts are logged too.
The run log
Every run leaves a receipt.
Search the whole history by script, person, target, parameters or anything in the output. Quoted phrases match exactly. Roll up repeat runs to see patterns instead of noise.
Open any run to watch it live, rerun it with the same inputs, or reverse it. Secret parameters are masked in the record.
- Script
- Grant-MailboxFullAccess
- Run by
- Jordan Alvarez · Script Operator
- Target
- contoso.onmicrosoft.com
- Parameters
- MailboxUPNs=finance@contoso.com
DelegateUPNs=m.chen@contoso.com
AutoMapping=True - Code version
- commit 03d031d
- Started
- Tue 09:14:02 · manual
- Status
- Completed · 7 s
- Output
- FullAccess granted on finance@contoso.com to m.chen@contoso.com (AutoMapping=True).
- Undo
- Revoke-MailboxFullAccess available
Everything else in the box
Built for the people who write the scripts, too.
Bring your own script (0:55) · Let AI write it (1:08) · PowerShell + Python (1:02)
Write and maintain.
- A PowerShell editor in the browser with completion for cmdlets and variables, hover help for the common Graph, Exchange and SharePoint cmdlets, and snippets.
- Git history for every script. See who changed what, compare any version, or compare your copy with the catalog original.
- Forms without UI code. A small settings file per script describes its parameters, required fields, defaults and choices.
- Python too. A script can carry a Python body that PowerShell calls at run time.
Schedule and notify.
- Schedules every few minutes, hourly, daily, weekly or monthly at a set time, with pause and run-now.
- Each schedule can carry its own credentials and notification settings, and never overlaps itself.
- Teams cards on completion or only on failure, sent through a Teams Workflow. No app registration or Graph permission needed.
- Output files in JSON, CSV, Excel, HTML and more, kept with the run or saved to a named file share.
Connect to your tenants.
- Several Microsoft 365 tenants from one install, using app-only auth with a client secret or certificate.
- A generated setup script creates the Entra app registration, grants the permissions and consent, and can include the Exchange setup.
- On-premises targets for Active Directory and Exchange, each tied to its own service account.
- Test connection and readiness checks tell you whether a missing cmdlet is a connection problem or a missing Exchange role.
Sign in your way.
- Microsoft (Entra ID) single sign-on, Active Directory domain passwords, or local accounts.
- Group-based grants read the groups on the user's sign-in, so existing Entra ID and AD groups work as they are.
- First-run setup asks for the first admin; nothing ships with a default password.
- Light, sepia and dark themes, guided tours and built-in help articles.
Deployment
One Windows service. One data file.
PowerScripts installs on a Windows server you already own and keeps your data there.
A single service.
The web app and API run as one Windows service that restarts itself on failure. No IIS, no SQL Server, no containers.
Stays on your server.
Runs, settings and scripts live in one local database file and a local Git repository. Download a copy from the app at any time.
Included in the package.
Exchange Online, Microsoft Graph, Teams and PnP PowerShell modules ship with PowerScripts. The server doesn't need PowerShell Gallery access.
A fresh process per run.
Each run starts its own PowerShell 7 process. When it ends, PowerScripts disconnects every session and stops the process.
Your certificate.
Point the installer at a certificate in the machine store by thumbprint. The service refuses to start if it can't find it.
In place, with rollback.
The updater checks the package hash, keeps the previous version, and rolls back if the new one doesn't answer. Your data isn't touched.
Beyond Microsoft 365
The same controls for your business systems.
Targets and stored credentials cover more than Microsoft. Starter scripts for PeopleSoft, Epicor Kinetic, SAP S/4HANA and Power BI use the same forms, grants and run log.
Failed run? Get a first diagnosis.
When a run fails, PowerScripts can ask a language model running on your own hardware to write up the likely cause, the evidence, what to check and a suggested fix. Nothing leaves your network.
Try it
Install in one line. Use it free for 14 days.
Run this in an elevated PowerShell window on the server. The installer adds PowerShell 7, registers the service and starts a 14-day trial.
PS> irm https://ps365vsstage01.z13.web.core.windows.net/install.ps1 | iex
- ServerWindows Server with administrator access
- RuntimePowerShell 7, installed for you
- Microsoft 365An Entra app registration (the app generates the setup script)
- On-premisesA service account per target, plus RSAT for Active Directory scripts
Rather see it first?
We'll walk through your own use cases on a live install, starting with the scripts your team runs most.
Moving from VitalSigns?
PowerScripts imports an export from the earlier VitalSigns release, including scripts, service accounts, targets and access rules. You can do a trial run first to see what will come across.