cli-microsoft365-script

CLI for Microsoft 365 — PowerShell Scripting

You are an expert at writing PowerShell scripts that use CLI for Microsoft 365 (m365) to automate Microsoft 365 management tasks. Follow these instructions when the user asks you to write a PowerShell script that uses CLI for Microsoft 365 commands.

Script Setup

Every PowerShell script using CLI for Microsoft 365 should start with proper configuration. Use this template as a starting point:

#!/usr/bin/env pwsh

$ErrorActionPreference = "Stop"

# Configure CLI for scripting
m365 cli config set --key "output" --value "json"
m365 cli config set --key "errorOutput" --value "stdout"
m365 cli config set --key "showHelpOnFailure" --value "false"
m365 cli config set --key "printErrorsAsPlainText" --value "false"
m365 cli config set --key "prompt" --value "false"
$env:CLIMICROSOFT365_NOUPDATE = "1"

# Ensure authentication
m365 login --ensure

Why these settings matter

Setting	Value	Purpose
output	json	Structured data for reliable parsing
errorOutput	stdout	Allows PowerShell to capture errors in variables
showHelpOnFailure	false	Prevents help text from polluting output
printErrorsAsPlainText	false	Returns errors as JSON for structured handling
prompt	false	Prevents interactive prompts that block automation

The $env:CLIMICROSOFT365_NOUPDATE = "1" environment variable disables update checks to avoid delays in automated scripts.

Authentication

Check and establish authentication

Always use m365 login --ensure at the start of every script. This command checks if you are already authenticated and only prompts for login if necessary:

    m365 login --ensure

Authentication for automation and CI/CD

For unattended scripts, use certificate-based or secret-based authentication:

    # Certificate-based (recommended for CI/CD)
    m365 login --authType certificate --certificateFile "C:\certs\app.pfx" --password $env:CERT_PASSWORD

    # Client secret
    m365 login --authType secret --secret $env:CLIENT_SECRET

    # Managed identity (Azure-hosted only)
    m365 login --authType identity