Others

PowerShell Script to Find Microsoft Commerce Policies with Self-Service Purchase Enabled

Maira Mehtab Sep 22, 2026 868 views

Question details

The user needs to create an automated monthly PowerShell script using certificate-based authentication to identify and export Microsoft Commerce policies that have Self-Service Purchase enabled.

Product: Microsoft Commerce API
Device & OS: not provided
Scenario: Automating a monthly service desk check for Self-Service Purchase policies in a Microsoft 365 tenant.
Observed behavior: The goal is to successfully authenticate non-interactively and output a CSV or JSON report containing the enabled product policies.

Before you start

Ensure you have global administrator or privileged role administrator access in Microsoft Entra ID to register an application and grant the necessary API permissions.

Solution 1Recommended

Build Automation via Entra ID App Registration and Microsoft Commerce API

Create an automated, non-interactive script using an Azure App Registration with certificate credentials.

To query Microsoft Commerce policies non-interactively, you must configure an Entra ID application with certificate-based authentication. This avoids prompt-based logins and enables scheduled runs via Azure Automation or a Windows Scheduled Task.

Register Entra ID Application

Grant API Permissions

Grant the application least-privilege API permissions for Microsoft Commerce or Microsoft Graph, and ensure a global admin grants admin consent.

Configure the PowerShell Script

Write a PowerShell script using Connect-MgGraph or MSAL to authenticate non-interactively using the App ID, Tenant ID, and certificate thumbprint.

Query Commerce Policies

Query the Microsoft Commerce API endpoint to filter and retrieve product policies where 'Self-Service Purchase' is explicitly enabled.

Export the Results

Export the filtered output to a CSV or JSON file using Export-Csv, appending a timestamp to the filename for service desk ticket processing.

API Documentation: Always verify the current API endpoints and exact permission scopes in the official Microsoft Graph or Microsoft Commerce documentation, as they are subject to change.

Solution 2

Leverage PowerShell Community Resources for Scripting Support

Reach out to expert communities for troubleshooting exact module commands and authentication syntax.

Free Microsoft Office alternative

Looking for a Cost-Effective Alternative to Microsoft 365?

While managing complex Microsoft Commerce policies and self-service purchases can be a headache for IT administrators, switching to WPS Office provides a streamlined, lightweight, and cost-effective solution for your organization's document productivity needs. It offers familiar interfaces and high compatibility without the overhead of complex enterprise policy management.

1. Download the Installer: Visit the official WPS website and click the download button for your operating system.
2. Install WPS Office: Run the downloaded installer and follow the simple on-screen instructions to set up the software.
3. Open and Edit Documents: Launch WPS Office and instantly open your existing Microsoft Office files with perfect formatting compatibility.

Highly compatible with Microsoft Excel, Word, and PowerPoint formatsLightweight application that uses fewer system resourcesNo complicated self-service purchase policies to manageFree to download with a familiar, easy-to-use tabbed interface

microsoft office alternative - wps office

Frequently Asked Questions

Can I use password authentication instead of a certificate for the scheduled PowerShell script?

It is highly discouraged and often blocked by modern conditional access policies. Certificate-based authentication is the Microsoft-recommended method for non-interactive, unattended scripts.

Which PowerShell module is required to query Microsoft Commerce policies?

You typically use the Microsoft Graph PowerShell SDK (Microsoft.Graph) or invoke REST APIs directly using Invoke-RestMethod against the Commerce API endpoints, depending on exact self-service purchase policy scopes.

Why does my script fail with insufficient privileges?

Ensure you have granted Admin Consent for the required API permissions in your Entra ID App Registration. Merely adding the permissions is not enough; a global administrator must explicitly approve them.

Office Quick Solutions