ARGUS — Governance Toolkit
Free, open-source PowerShell module for Microsoft 365 governance assessments: 73 read-only checks, a Governance Score and an HTML report that explains every finding and how to fix it.
ARGUS has its own page: dbianchi.it/en/argus, with the demo report to try, the video and the full check catalogue.
What it does
ARGUS (Automated Report & Governance Utility Suite) runs governance and hygiene checks against a Microsoft 365 tenant, computes a weighted Governance Score and produces a self-contained HTML report (plus JSON and optional CSV) listing every check, what was found and how to fix it.
It is strictly read-only: it never writes, changes or deletes anything in the tenant. The remediation code in the report is a sample, never executed.
Areas covered
| Area | Checks | Examples |
|---|---|---|
| Entra ID | 15 | inactive members and guests, guests without sponsor, break-glass accounts, Global Administrator count |
| Applications | 7 | app registrations without owners, expiring or long-lived secrets and certificates |
| Licensing | 8 | licences on disabled or inactive users, overlapping licences, unused seats per SKU |
| Groups & Teams | 8 | creation, naming and expiration policies, ownerless groups and Teams, inactive Teams |
| SharePoint & OneDrive | 13 | default sharing, Anyone links, orphaned and inactive sites, quotas, OneDrive of leavers |
| Exchange Online | 10 | shared mailboxes with sign-in, inactive mailboxes, forwarding, distribution groups without owner |
| Copilot & agents | 12 | self-service purchase and trials, unused Copilot licences, web search, agent sharing |
It is not a security baseline: no CIS, MFA or Conditional Access checks; dedicated tools such as Maester cover those.
Report
- Governance Score from 0 to 100 with a grade from A to F, overall and per area
- For every check: what was found, why it matters, how to fix it, Microsoft Learn references
- Search, filters and CSV export of the findings
- One HTML file with no external dependencies, light and dark mode, printable as PDF
Tech stack
- PowerShell 7.2+ on Windows, macOS and Linux
- Microsoft Graph (only
Microsoft.Graph.Authenticationis required), with JSON batching - Optional ExchangeOnlineManagement, PnP.PowerShell and MSCommerce: without them, the checks that need them are Skipped
- Delegated interactive sign-in or app-only with a certificate
- Pester and PSScriptAnalyzer in CI on GitHub Actions; published on the PowerShell Gallery
Installation
Install-Module ARGUS -Scope CurrentUser
Connect-Argus
Invoke-Argus
Full guide, app-only and least privilege in the README on GitHub.