What PowerShell is great at
PowerShell (via Microsoft.Graph PowerShell SDK, ExchangeOnlineManagement, MicrosoftTeams modules) covers every M365 admin operation Microsoft exposes via API. For an IT pro comfortable in the shell:
- Bulk operations are trivial: 500 users from a CSV in one loop, no clicking through wizards
- Repeatable: the script is documentation. Run it again next quarter, same result
- Composable: pipe Graph results into Exchange operations into SharePoint operations
- Free: no licensing cost beyond M365 itself
- Versionable: scripts live in Git, reviewed, audited
- Power-user friendly: complex logic (conditional license assignment by job code, etc.) is trivial vs trying to do it in a UI
For the things PowerShell is right for, it's really right. UserDesk isn't trying to replace PowerShell for those use cases.
Where PowerShell breaks for delegation
PowerShell only works as a delegation tool if the delegate can read + run the script. That works for IT pros. It fails for everyone else.
Specifically:
- HR can't use it. Your HR person isn't going to open Windows Terminal, paste a script, hit enter. Even with a wrapper UI like a Forms-based input, they need IT to maintain that wrapper.
- No per-delegate audit by default. If you don't add logging explicitly, there's no record of who ran what when. You can add it, but you have to add it.
- Permissions live wherever you stored the credentials. Service principal? Cert? Cached creds? Each option has security trade-offs. None are as clean as "delegated OAuth scoped to the signed-in user."
- Breaks when modules deprecate. Microsoft has retired or renamed core modules multiple times (MSOnline → AzureAD → Microsoft.Graph being the most recent). Scripts that worked in 2023 may not work in 2026 without updates.
- No UI for the delegate. If the delegate can't self-serve, the bottleneck is still you (the script-runner). PowerShell isn't delegation — it's IT's own tooling.
Side-by-side comparison
| Feature | PowerShell scripts | UserDesk |
|---|---|---|
Cost | Free (your time + maintenance) | $79–149/mo per tenant |
Who can run it | IT pros only | HR / office mgr / team lead / IT — any role |
Setup time | Hours to set up auth + first scripts | ~2 min (admin consent + portal share) |
Bulk operations (300 users at once) | Yes | No |
Audit trail (built-in) | Manual — whatever you log | Per-delegate, automatic |
Maintenance burden | Real — Microsoft deprecates modules; scripts break | None — we update; you get the new behavior |
UI for non-IT delegate | No | Yes |
Onboarding templates | Build yourself in script logic | Pre-built — define once, run every time |
Mobile-friendly | No | Yes |
Permissions model | Whatever creds you cached (service principal, cert, app password) | Delegated OAuth scoped to the signed-in user |
Composable with other systems | Highly | Limited (no API yet) |
Comparison verified
When PowerShell is the right answer
Stay on PowerShell when you (IT) handle everything yourself.
The signals PowerShell is genuinely correct:
- One-person IT shop; you do every admin task yourself
- Bulk operations are common (migrations, quarterly cleanup, mass license changes)
- You're comfortable maintaining scripts as Microsoft updates modules
- Complex conditional logic (license by department + role + start date) is part of the workflow
- You need the scripts to compose with other tools (HRIS pulls, CSV imports, audit pipeline)
- The work is YOUR work; there's no delegate to hand it off to
For these cases, paying $79/mo for a UI tool when you have a working script library is wasteful. Don't.
When a UI tool is the right answer
Pick UserDesk when someone else does the work.
The signals UserDesk fills a gap PowerShell can't:
- HR, office manager, or team lead is the delegate — they're not running scripts
- You want to STOP being the bottleneck for every password reset
- The delegate needs to do their work from a phone (HR while on a call, etc.)
- Per-delegate audit trail matters for compliance / weekly review
- You don't want to maintain a script wrapper UI yourself
- The delegate needs to act independently without your involvement
The math: 1 hour/week of your time at $80/hr loaded = $320/mo of value. UserDesk Starter $79/mo = ~4x ROI. The real win is the interruption tax going away, not the dollar count.
The common 'use both' pattern
Many SMB IT folks keep PowerShell + add UserDesk for handoff.
You keep PowerShell for:
- Bulk migration ops (your work)
- Quarterly license cleanup (your work)
- Custom report generation (your work)
- HRIS sync workflows that run on schedule
UserDesk handles:
- HR's daily password resets (delegated)
- New-hire creation by HR with templates (delegated)
- Team lead managing Teams membership (delegated)
No conflict — PowerShell uses service-principal auth or your own credentials; UserDesk uses delegated OAuth scoped to the delegate. Both leave full audit trails in Microsoft Purview either way.
Frequently asked questions
Q01Can I wrap PowerShell scripts in a UI for HR?
Technically yes — Microsoft Forms triggering a Power Automate flow triggering a script is a common pattern. The catch: you're now maintaining the Forms layer + the Automate flow + the script + the auth + the audit pipeline. That's 4 things that break independently. A focused tool collapses all of that into one product that someone else maintains. Worth doing if you enjoy the building; not worth doing if your time is better spent elsewhere.
Q02Does UserDesk expose a PowerShell API?
Not today. UserDesk is a delegate-facing portal, not an automation API. If you need scripted operations alongside delegation, run PowerShell against Microsoft Graph directly for the script side — UserDesk doesn't need to sit in the middle. They don't conflict.
Q03How much time does PowerShell maintenance actually take?
Depends on script complexity. Microsoft deprecates auth modules every 18–36 months (MSOnline → AzureAD → Microsoft.Graph, V1 → V2 of various modules). Each deprecation cycle takes a few hours to a few days to migrate scripts. For a small library of 5–10 scripts: ~4–8 hours per cycle, ongoing. Not a lot if you only have a few scripts; meaningful if your library is bigger.
Q04Is there a 'best of both worlds' option?
Run both. PowerShell for the work you do yourself; UserDesk for the work you want HR to do. They don't conflict. Total cost is still just $79/mo for UserDesk Starter on top of your existing PowerShell infrastructure.
Q05What about Microsoft Graph PowerShell SDK specifically?
Microsoft.Graph is the current Microsoft-supported PowerShell SDK for M365 admin (after the AzureAD module deprecation). It's the right module to use if you're writing new scripts today. Doesn't change the delegation analysis — PowerShell-via-Graph is still for IT to run, not for HR.
Try it
Free 14-day trial — no card
Connect your Microsoft 365 tenant in 2 minutes. Hand the portal to HR or your team leads. Cancel any time.
Free checklist
M365 Delegation Checklist
What to delegate, what to keep, and how to set it up without breaking your tenant.