Forum Discussion
Find all sites where specific AD groups are used
Is there a PowerShell command for finding out where specific AD groups are used in SharePoint Online? We have several old AD groups that were used at one time and added to SharePoint groups for permi...
I had need of a solution to this as well, so I figured I would share what I've done.
I did some research, and I had some scripts already as starting points, but everything seemed to be based on crawling through all the list items in the all the lists in all site collections/subsites/modern sites etc. Clearly in even a moderately sized tenant that would be slow.
I considered using Powershell jobs to do more in paraellel but it was clearly still going to be slow.
In the end, I settled on a different approach which is to get information from the "User Information List" for each site collection/modern site/group site.
When I have a few minutes I will share a script via GitHub, but the plan is to recurse through all the sites on a tenant and export the Information from the user information lists, but you might consider looking at this as a starting point - https://www.sharepointdiary.com/2018/08/sharepoint-online-export-user-information-list-using-powershell.html
There are some caveats to this approach -
- It won't tell you what access they have within the site
- The list can include stale entries, so if the group had access and it has been removed it may still be there.
However, there are permissions report scripts which you could use to get the detail or you could even just check manually using 'Method 1' from here - https://sharepointmaven.com/2-ways-see-users-access-sharepoint/
Hope this helps.
I did some research, and I had some scripts already as starting points, but everything seemed to be based on crawling through all the list items in the all the lists in all site collections/subsites/modern sites etc. Clearly in even a moderately sized tenant that would be slow.
I considered using Powershell jobs to do more in paraellel but it was clearly still going to be slow.
In the end, I settled on a different approach which is to get information from the "User Information List" for each site collection/modern site/group site.
When I have a few minutes I will share a script via GitHub, but the plan is to recurse through all the sites on a tenant and export the Information from the user information lists, but you might consider looking at this as a starting point - https://www.sharepointdiary.com/2018/08/sharepoint-online-export-user-information-list-using-powershell.html
There are some caveats to this approach -
- It won't tell you what access they have within the site
- The list can include stale entries, so if the group had access and it has been removed it may still be there.
However, there are permissions report scripts which you could use to get the detail or you could even just check manually using 'Method 1' from here - https://sharepointmaven.com/2-ways-see-users-access-sharepoint/
Hope this helps.