back to website

Werk #17684: Deprecation of MSOnline Powershell module in mk_msoffice.ps1

Component Agent bakery
Title Deprecation of MSOnline Powershell module in mk_msoffice.ps1
Date May 15, 2025
Level Prominent Change
Class New Feature
Compatibility Incompatible - Manual interaction might be required
Checkmk versions & editions
2.5.0b1
Not yet released 		Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.4.0p9 Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.3.0p35 Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)

As of March 30, 2024, Microsoft officially deprecated the MSOnline PowerShell Module (end of support: March 30, 2025). This means:

  • Scripts using versions below 1.1.166.0 will no longer work after June 30, 2024.
  • Scripts using any version of the MSOnline PowerShell Module will be deprecated by March 30, 2025.

Microsoft encourages migrating these scripts to use the Microsoft Graph PowerShell SDK.

Prerequisites

The following prerequisites are required to use the Microsoft Graph PowerShell SDK:

  1. Upgrade to PowerShell 5.1 or later.
  2. Force TLS 1.2 for secure communication.

Optionally:

  1. Install .NET Framework 4.7.2 or later.
  2. Update PowerShellGet to the latest version using: Install-Module PowerShellGet

Permissions

Please be aware that to connect to MgGraph and retrieve license information, special permissions must be granted in the Microsoft Entra admin center to your app registration:

  • Least privileged permissions: LicenseAssignment.Read.All
  • Higher privileged permissions: Directory.Read.All / Organization.Read.All

Steps to Maintain Compatibility

To maintain compatibility, mk_msoffice.ps1 has been rewritten to use the new Microsoft Graph PowerShell SDK logic. Perform the following steps to continue using the "MS Office 365 (Windows)" feature:

  1. Inside the "MS Office 365 (Windows)" bakery rule, replace the username/password with a valid client ID, tenant ID, and client secret.

  2. Add the following configurations:

  3. Set execution mode for plug-ins and local checks: Asynchronous.

  4. Set cache age for plug-ins and local checks: 14400 seconds.
  5. Set timeouts for plug-ins and local checks: 600 seconds.

In case you don't use bakery rules, you need to copy the agent plugin mk_msoffice.ps1 to %SystemDrive%\ProgramData\checkmk\agent\plugins and create a configuration file using the example msoffice_cfg.json in %SystemDrive%\ProgramData\checkmk\agent\config.

Important: The old "MS Office 365 (Windows)" bakery rule will no longer work without manual intervention. Please take the above-mentioned actions to prevent issues with MS Office monitoring on Windows.

New Feature

A new feature has been added to retrieve the client secret from the password store.

To the list of all Werks