Find all sites where specific AD groups are used

%3CLINGO-SUB%20id%3D%22lingo-sub-1800998%22%20slang%3D%22en-US%22%3EFind%20all%20sites%20where%20specific%20AD%20groups%20are%20used%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1800998%22%20slang%3D%22en-US%22%3E%3CP%3EIs%20there%20a%20PowerShell%20command%20for%20finding%20out%20where%20specific%20AD%20groups%20are%20used%20in%20SharePoint%20Online%3F%20We%20have%20several%20old%20AD%20groups%20that%20were%20used%20at%20one%20time%20and%20added%20to%20SharePoint%20groups%20for%20permissions.%20I%20need%20to%20find%20out%20if%20they%20are%20still%20used%20anywhere%20so%20I%20can%20delete%20the%20ones%20that%20are%20not.%20Is%20there%20a%20PowerShell%20script%2C%20I'm%20guessing%20using%20Get-SPOUser%2C%20out%20there%20that%20will%20tell%20me%20what%20sites%20are%20still%20using%20a%20specific%20AD%20group%20in%20a%20SharePoint%20permissions%20group%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1800998%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EPermissions%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EPowerShell%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESharePoint%20Online%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Frequent Contributor

Is there a PowerShell command for finding out where specific AD groups are used in SharePoint Online? We have several old AD groups that were used at one time and added to SharePoint groups for permissions. I need to find out if they are still used anywhere so I can delete the ones that are not. Is there a PowerShell script, I'm guessing using Get-SPOUser, out there that will tell me what sites are still using a specific AD group in a SharePoint permissions group?

1 Reply
I had need of a solution to this as well, so I figured I would share what I've done.

I did some research, and I had some scripts already as starting points, but everything seemed to be based on crawling through all the list items in the all the lists in all site collections/subsites/modern sites etc. Clearly in even a moderately sized tenant that would be slow.
I considered using Powershell jobs to do more in paraellel but it was clearly still going to be slow.

In the end, I settled on a different approach which is to get information from the "User Information List" for each site collection/modern site/group site.

When I have a few minutes I will share a script via GitHub, but the plan is to recurse through all the sites on a tenant and export the Information from the user information lists, but you might consider looking at this as a starting point - https://www.sharepointdiary.com/2018/08/sharepoint-online-export-user-information-list-using-powersh...
There are some caveats to this approach -
- It won't tell you what access they have within the site
- The list can include stale entries, so if the group had access and it has been removed it may still be there.
However, there are permissions report scripts which you could use to get the detail or you could even just check manually using 'Method 1' from here - https://sharepointmaven.com/2-ways-see-users-access-sharepoint/

Hope this helps.