Forum Discussion
Kevin_Hoyt
Oct 20, 2020Iron Contributor
Find all sites where specific AD groups are used
Is there a PowerShell command for finding out where specific AD groups are used in SharePoint Online? We have several old AD groups that were used at one time and added to SharePoint groups for permissions. I need to find out if they are still used anywhere so I can delete the ones that are not. Is there a PowerShell script, I'm guessing using Get-SPOUser, out there that will tell me what sites are still using a specific AD group in a SharePoint permissions group?
1 Reply
Sort By
- justinroyal
Microsoft
Hi sharukh can you please file a ticket for this within Partner Center?
- sharukhCopper Contributor
Hi justinroyal i Just summited the case with partner center, ticket id- 2504090040005120. Thank you
- JillArmourMicrosoft
Community Manager
justinroyal can you help here? Thank you kindly.
- Matt_CookCopper ContributorI had need of a solution to this as well, so I figured I would share what I've done.
I did some research, and I had some scripts already as starting points, but everything seemed to be based on crawling through all the list items in the all the lists in all site collections/subsites/modern sites etc. Clearly in even a moderately sized tenant that would be slow.
I considered using Powershell jobs to do more in paraellel but it was clearly still going to be slow.
In the end, I settled on a different approach which is to get information from the "User Information List" for each site collection/modern site/group site.
When I have a few minutes I will share a script via GitHub, but the plan is to recurse through all the sites on a tenant and export the Information from the user information lists, but you might consider looking at this as a starting point - https://www.sharepointdiary.com/2018/08/sharepoint-online-export-user-information-list-using-powershell.html
There are some caveats to this approach -
- It won't tell you what access they have within the site
- The list can include stale entries, so if the group had access and it has been removed it may still be there.
However, there are permissions report scripts which you could use to get the detail or you could even just check manually using 'Method 1' from here - https://sharepointmaven.com/2-ways-see-users-access-sharepoint/
Hope this helps.