An experienced Microsoft 365 administrator has published a detailed account of the technical obstacles encountered while developing an open-source management layer on top of Microsoft Graph and Exchange Online.
The project, now at version 2.0 and called SwissKnife for MS Graph, evolved from a simple utility for adding users to group chats into a full engine that can preview any change before applying it through Microsoft Graph, Exchange Online PowerShell or LDAP.
Because the native Microsoft 365 and Graph interfaces lack a reliable “what-if” mode, every action in the tool is split into two explicit steps: a read-only planning phase that lists every object, field and value change, followed by an apply phase that executes only the approved list and records the outcome in an audit log.
The author highlights several persistent limitations in Microsoft services. Microsoft Graph still does not cover many common Exchange operations such as full mailbox access, Send As permissions or transport rules, forcing the tool to fall back to the preview-stage Exchange Admin API or to Exchange Online PowerShell module version 7.6.
On macOS and Linux the Security & Compliance endpoint is unavailable, so the solution introduces a Windows-based worker that executes only whitelisted cmdlets over mutual TLS without storing tokens locally.
Configuration rollback proved even harder than snapshot creation. Named locations referenced by Conditional Access policies receive new IDs when recreated, Intune returns secrets as null or masked values, and some Intune fields change automatically, creating perpetual drift. Transport rules also lack sufficient detail in Get-TransportRule output to be reliably recreated from a snapshot.
To mitigate risks from community scripts, every package declares its required cmdlets in advance. The host parses the script with the PowerShell AST, rejects undeclared commands or dynamic invocation, and runs the code in Constrained Language mode. Packages from the official catalog are signed with minisign; others require explicit digest approval before execution.
The tool additionally offers natural-language task search via Ctrl+K, access mirroring between users, Entra sign-in failure analysis, and read-only profiles for on-call staff. It is available for Windows, macOS and Linux with MIT license and requires administrators to register their own Entra application with least-privilege permissions.


