Client Services activity report (serverless)

A recurring monthly report summarizing Microsoft 365 activity (email, Teams, SharePoint, and OneDrive usage) for Client Services and Reconciliation staff. The reporting logic already existed; this project moved it off an on-prem scheduled task and onto a serverless Azure Automation runbook, and in doing so removed the whole class of infrastructure the old design depended on.

The migration

• From a PowerShell script on an on-prem box behind Windows Task Scheduler, with the credential handling and patching that implies.
• To an Azure Automation runbook (PowerShell 7.4) triggered on a schedule in the cloud, with no server to maintain.
• Auth a system-assigned managed identity calling Microsoft Graph. No certificates to rotate, no client secret to store, no credential to leak.

What it produces

Each run filters the target audience by department region code and by an extension attribute identifying Client Services and Reconciliation roles, aggregates a 30-day rolling window of email, Teams, SharePoint, and OneDrive usage (Graph usage data lags roughly two days), and emails the result to a configurable recipient list.

Operational details

• Config without redeploy recipient and sender addresses live in Automation variables editable in the portal, so changing them does not require republishing the runbook.
• Send scoping identified as an open item the Mail.Send permission is currently tenant-wide as an application permission; scoping it to the single no-reply mailbox via an Exchange Online application access policy is a documented next step, not yet complete.
• No secrets anywhere the managed-identity model means there is no stored credential in the runbook, in a vault, or on a host.