Tenant-wide user and guest settings (authorization policy)

#Requires -Modules Microsoft.Graph.Authentication
# Tenant-wide default user and guest settings from the authorization policy. Read-only (GET request only).

Connect-MgGraph -Scopes 'Policy.Read.All' -NoWelcome

$policy = Invoke-MgGraphRequest -Method GET -Uri '/v1.0/policies/authorizationPolicy'
$defaults = $policy['defaultUserRolePermissions']

$guestRoles = @{
    'a0b1b346-4d3e-4e8b-98f8-753987be4970' = 'User (same access as members)'
    '10dae51f-b6af-4016-8d66-8c2a99b929b3' = 'Guest User (limited access, the default)'
    '2af84b1e-32c8-42b7-82bc-daa82404023b' = 'Restricted Guest User (most restrictive)'
}
$guestRoleId = "$($policy['guestUserRoleId'])"
$guestRole = if ($guestRoles.ContainsKey($guestRoleId)) { $guestRoles[$guestRoleId] } else { $guestRoleId }

$settings = [ordered]@{
    'Users can register applications'                 = $defaults['allowedToCreateApps']
    'Users can create security groups'                = $defaults['allowedToCreateSecurityGroups']
    'Non-admin users can create tenants'              = $defaults['allowedToCreateTenants']
    'Device owners can read their BitLocker keys'     = $defaults['allowedToReadBitlockerKeysForOwnedDevice']
    'User consent policies assigned'                  = $defaults['permissionGrantPoliciesAssigned'] -join ', '
    'Users can consent to risky apps'                 = $policy['allowUserConsentForRiskyApps']
    'Who can invite guests'                           = $policy['allowInvitesFrom']
    'Guest user access'                               = $guestRole
    'Users can join the tenant by email verification' = $policy['allowEmailVerifiedUsersToJoinOrganization']
    'Users can sign up for email-based subscriptions' = $policy['allowedToSignUpEmailBasedSubscriptions']
    'Administrators can use self-service password reset' = $policy['allowedToUseSSPR']
    'MSOnline PowerShell blocked'                     = $policy['blockMsolPowerShell']
}

$settings.GetEnumerator() | ForEach-Object { [pscustomobject]@{ Setting = $_.Key; Value = $_.Value } }

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

• Reads the policy with a GET request, so each value is exactly what the authorizationPolicy resource documents. Labels in the Setting column are the plain-English meaning; the linked pages give the matching Entra admin centre setting.
• "User consent policies assigned" is empty when user consent to apps is turned off. A value such as ManagePermissionGrantsForSelf.microsoft-user-default-low means users can consent within that app consent policy.
• "Who can invite guests" is one of none, adminsAndGuestInviters, adminsGuestInvitersAndAllMembers or everyone (the default outside US Government clouds).
• "Non-admin users can create tenants" is the opposite of the admin centre's "Restrict non-admin users from creating tenants".

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.