PowerShell is the automation language Microsoft bet the Azure platform on, and that bet has paid off: the Az module manages every Azure resource, Exchange and Microsoft 365 administration is almost entirely PowerShell-driven, and PowerShell 7 runs on Linux inside containers as comfortably as on Windows. If your work touches Azure, Active Directory, Intune, or the Microsoft 365 stack, PowerShell is not optional — it is the primary interface. The good news is that its object-pipeline model, once understood, is genuinely more powerful than text-piping shells.
What changed in 2026
- PowerShell 7.4/7.5 LTS is the stable target. Security-patched and stable; Windows PowerShell 5.1 is legacy, ships with Windows, and stays for compatibility.
- Az module 12.x. The official Azure PowerShell module tracks ARM/Bicep changes monthly.
Connect-AzAccount works with managed identities, workload identity federation, and device flow.
- Microsoft Graph SDK for PowerShell v2. The
Microsoft.Graph module replaced the legacy AzureAD module; anything touching Entra ID uses it now.
- SecretManagement 1.5 + SecretStore. The
Microsoft.PowerShell.SecretManagement module provides a vault-agnostic API for credentials — no more plaintext passwords in scripts.
- PowerShell Universal 5. Low-code dashboards and REST APIs from PowerShell scripts, used heavily in IT automation shops.
The learning path
Week 1: the object pipeline
The fundamental insight in PowerShell is that cmdlets pass objects, not strings:
# Get services, filter, select specific properties
Get-Service |
Where-Object { $_.Status -eq 'Running' } |
Select-Object Name, DisplayName, StartType |
Sort-Object Name
# Objects have types — inspect them with Get-Member
Get-Process | Get-Member -MemberType Property
No parsing, no awk, no cut. Properties are just there.
Week 2: cmdlet conventions and help
PowerShell cmdlets follow Verb-Noun naming. The approved verbs are documented (Get-Verb) and every well-written module uses them.
# Get-Help is your REPL documentation
Get-Help Get-Process -Full
Get-Help Get-Process -Examples
# Update-Help downloads current docs
Update-Help -Force
# Tab-completion + IntelliSense work in VS Code and Windows Terminal
Get-Az<TAB> # lists all Az cmdlets
(Get-Date).<TAB> # lists methods and properties on DateTime
Week 3: scripting fundamentals
#Requires -Version 7.0
[CmdletBinding()]
param(
[Parameter(Mandatory)]
[string]$ResourceGroup,
[Parameter()]
[ValidateSet('eastus', 'westeurope', 'uksouth')]
[string]$Location = 'eastus'
)
Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'
function Get-ResourceGroupStatus {
[CmdletBinding()]
param([string]$Name)
$rg = Get-AzResourceGroup -Name $Name -ErrorAction SilentlyContinue
if (-not $rg) {
Write-Warning "Resource group '$Name' not found."
return $null
}
[PSCustomObject]@{
Name = $rg.ResourceGroupName
Location = $rg.Location
State = $rg.ProvisioningState
}
}
Get-ResourceGroupStatus -Name $ResourceGroup
[CmdletBinding()], param(), Set-StrictMode, and $ErrorActionPreference = 'Stop' are the PowerShell equivalent of Bash's set -euo pipefail.
Week 4: error handling and secrets
# Try/Catch/Finally
try {
$vm = Get-AzVM -ResourceGroupName $rg -Name $vmName
Stop-AzVM -ResourceGroupName $rg -Name $vmName -Force
}
catch [Microsoft.Azure.Commands.Compute.Common.ComputeCloudException] {
Write-Error "VM operation failed: $_"
throw
}
finally {
Write-Verbose "VM operation attempt complete"
}
# SecretManagement for credentials
$secret = Get-Secret -Name 'DbPassword' -Vault 'LocalStore'
$cred = [PSCredential]::new('dbuser', $secret)
Comparison: PowerShell vs Bash vs Python for automation in 2026
| Task |
PowerShell 7 |
Bash |
Python |
| Azure/M365 management |
Best in class |
Poor |
Good (SDK) |
| Windows Active Directory |
Native |
Not possible |
Partial |
| Cross-platform support |
Yes (PS7) |
Linux/macOS |
Yes |
| Object manipulation |
Excellent |
Text-only |
Excellent |
| Error handling |
Structured try/catch |
Fragile |
Structured |
| Startup time |
~200 ms |
~5 ms |
~50 ms |
| Community modules |
PSGallery (~14 k) |
Small |
PyPI (huge) |
How to pick your first project
- An Azure resource inventory script — list VMs, their sizes, and their running state; export to CSV. Touches
Get-AzVM, Select-Object, Export-Csv.
- A Microsoft 365 user report — pull licensed users, their last login, and manager. Uses
Microsoft.Graph module.
- An automated backup or cleanup script for Windows file servers — practical, testable, and uses only built-in cmdlets.
Common mistakes
Mixing PowerShell 5.1 and PS7 syntax. Modules that work in 5.1 often fail in PS7 and vice versa. Always specify #Requires -Version 7.0 in new scripts.
Not using $ErrorActionPreference = 'Stop'. Without it, many cmdlets swallow errors and your script happily continues after a failure.
Storing credentials in plain text. Use SecretManagement or environment variables injected by your CI system — never hardcode or ConvertTo-SecureString with a literal password in source.
Writing one 400-line script. Break at 50–80 lines per function. PowerShell is fully functional as a module system; use it.
Ignoring [OutputType()] and Write-Output vs return. PowerShell functions return everything written to the output stream. Accidentally returning a debug string alongside your object breaks callers silently.
What to skip
- Windows PowerShell ISE — it is legacy; use VS Code with the PowerShell extension.
Invoke-Expression — it evals strings as code; almost always there is a safer pattern.-ExecutionPolicy Bypass in production — fix the signing or use RemoteSigned; bypass is a security anti-pattern.
FAQ
Is PowerShell worth learning if I mostly use Linux?
If you touch Azure, Microsoft 365, or Intune at any point, yes — the tooling assumes PS7. For pure Linux infrastructure, Bash + Python covers more ground.
What is the difference between PowerShell and CMD?
Completely different. CMD (Command Prompt) is 1980s-era Windows shell. PowerShell is a modern, object-oriented shell that happens to also run on top of Windows. They share almost nothing.
How do I run PowerShell scripts securely in CI?
Use a managed identity or workload identity federation to authenticate to Azure — no stored passwords. Inject secrets via environment variables from your vault (Azure Key Vault, GitHub Secrets).
What is the best learning resource for PowerShell in 2026?
"Learn PowerShell" at learn.microsoft.com is free and current. The PowerShell documentation team keeps it updated with PS7 examples.
Where to go next