How to list users synced from onprem AD and cloud-only users?

[Teijo Hämäläinen]

Hello guys!

I was tasked to list users synced from onprem AD and cloud only users

I have downloaded and imported AzureAD PS module 2.0.2.16

Azure portal shows several users with source 'Azure Active Directory'.

I'm first trying to list these cloud-only users by running a command command  Get-AzureADUser | where {$_.dirsyncenabled -eq $false} but it yields only one user when there should be a lot more.

I also need to list users synced from onprem AD.

My command does not seem to do the trick. Can you help me out?

[#2 · Accepted solution]

@Teijo Hämäläinen I would try following Get-MsolUser -All | ?{-not $_.lastdirsynctime}

[#3]

There's also Get-MsolUser -Synchronized. Using the server-side filtering is faster approach, and also makes sure you don't get a trimmed list because of hitting the limit for number of objects returned (like when you have the Get-AzureADUser cmdlet above, without the -All switch, and filtering client-side).

[#4]

thanks, definitely a better solution.

Martin

[#5]

@Martin RublikThere is another easier option to use it. Cloud only and on prem users have big difference - Its called Immutable ID

So Get-MsolUser | where-Object {$_.ImmutableId -eq $null} -> for On prem users

Get-MsolUser | where-Object {$_.ImmutableId -ne $null} for Azure AD users ( Cloud users)

[#6]

@Martin Rublik 

Thank you Martin (and Scorpio and Vasil), your solution help me forward.

[#7]

@Scorpio69 

I think should be other way around :)

Get-MsolUser | where-Object {$_.ImmutableId -eq $null} -> for Azure AD cloud users;

Get-MsolUser | where-Object {$_.ImmutableId -ne $null} -> for On premise users;

[#8]

@Scorpio69  Definitively need -All switch to get all users.

Get-MsolUser -All | where-Object {$_.ImmutableId -eq $null}

[#9]

@Teijo Hämäläinen 

I would recommend using the AzureAD PowerShell Module. You can use the following command to get a list of all Cloud Only Accounts:

Get-AzureADUser -All $true | Where-Object {$_.ImmutableId -eq $null}

If you want a list with the Cloud Only Accounts without guests, you could use the following command:

Get-AzureADUser -All $true | Where-Object {$_.ImmutableId -eq $null -and $_.UserPrincipalName -notlike "*#EXT#*"}

[#10]

You need to use the new Microsoft Graph PowerShell SDK to retrieve this information.

The below article has a script that will export that information and much more:

https://www.alitajran.com/export-azure-ad-users-to-csv-powershell/