SOLVED

M365/AzureAD Equivalent Powershell Command for Get-ADPrincipalGroupMembership

%3CLINGO-SUB%20id%3D%22lingo-sub-2350874%22%20slang%3D%22en-US%22%3EM365%2FAzureAD%20Equivalent%20Powershell%20Command%20for%20Get-ADPrincipalGroupMembership%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2350874%22%20slang%3D%22en-US%22%3E%3CDIV%20class%3D%22thread-message-content-body-text%20thread-full-message%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMy%20question%20is%2C%20does%20a%20cmdlet%20exist%20that%20does%20the%20equivalent%20function%20of%20%3CEM%3EGet-ADPrincipalGroupMembership%3C%2FEM%3E%20for%20M365%20or%20AzureAD%2C%20and%20if%20not%20is%20there%20a%20way%20to%20achieve%20a%20similar%20functionality%20%3CU%3Ewithout%3C%2FU%3E%20enumerating%20and%20comparing%20every%20single%20group%20in%20a%20tenant.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20administrate%20a%20large%20number%20of%20Microsoft%20365%20tenants%20as%20well%20as%20local%20Active%20Directory%20for%20many%20companies.%20As%20part%20of%20this%20I%20frequently%20have%20to%20add%2Fmove%2Fchange%20user%20accounts.%20I%20have%20automated%20a%20fair%20amount%20of%20these%20changes%20via%20PowerShell%20with%20the%20Msol%20and%20ExchangeOnline%20modules.%20I%20have%20run%20into%20a%20road%20block%20however%20with%20updating%20a%20single%20user's%20group%20memberships.%20For%20on-premise%20AD%2C%20there%20exists%20the%20%3CEM%3EGet-ADPrincipalGroupMembership%20%3C%2FEM%3Ecmdlet%2C%20which%20allows%20me%20to%20specify%20a%20user%20and%20then%20returns%20all%20groups%20they%20are%20part%20of.%20I%20want%20to%20do%20the%20same%20thing%20with%20M365%20and%20groups%20of%20all%20types%20(distribution%2C%20security%2C%20M365%2C%20etc.)%20but%20have%20been%20unable%20to%20find%20a%20cmdlet%20in%20any%20module%20that%20can%20do%20this.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20looked%20at%20using%20the%20%3CEM%3EGet-MsolGroups%20%3C%2FEM%3Eand%20the%20%3CEM%3EGet-UnifiedGroups%3C%2FEM%3E%20cmdlets%20to%20enumerate%20the%20entire%20tenant's%20groups%20to%20an%20array%2C%20then%20use%20%3CEM%3EGet-MsolGroupMember%20%3C%2FEM%3Eand%20the%20%3CEM%3EGet-UnifiedGroupLinks%3C%2FEM%3E%20to%20run%20a%20comparison%20of%20every%20single%20member%20of%20every%20group%20against%20the%20user%20I%20am%20looking%20for.%20This%20method%20is%20overly%20complex%2C%20and%20drastically%20increases%20program%20runtime%20as%20it%20scans%20through%20many%20thousands%20of%20entries%20just%20to%20find%20the%205%20or%2010%20I'm%20looking%20for.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20know%20this%20is%20possible%20at%20least%20in%20some%20sense%2C%20because%20both%20the%20AzureAD%20and%20the%20general%20M365%20admin%20center%20GUI's%20are%20able%20to%20instantly%20pull%20up%20all%20of%20a%20user's%20group%20memberships%20when%20looking%20at%20the%20account.%20It%20may%20just%20be%20Microsoft%20has%20not%20yet%20built%2Fmade%20available%20a%20PowerShell%20cmdlet%20that%20utilizes%20this%20functionality.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20insight%20would%20be%20appreciated!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%20class%3D%22%22%3EThanks%3C%2FP%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2350874%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Active%20Directory%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EWindows%20PowerShell%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2351906%22%20slang%3D%22en-US%22%3ERe%3A%20M365%2FAzureAD%20Equivalent%20Powershell%20Command%20for%20Get-ADPrincipalGroupMembership%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2351906%22%20slang%3D%22en-US%22%3EFor%20Exchange%20Online%2C%20use%20this%3A%3CBR%20%2F%3E%3CBR%20%2F%3EGet-Recipient%20-Filter%20%22Members%20-eq%20'CN%3Duser%2COU%3Ddomain.onmicrosoft.com%2COU%3DMicrosoft%20Exchange%20Hosted%20Organizations%2CDC%3DEURPR03A001%2CDC%3Dprod%2CDC%3Doutlook%2CDC%3Dcom'%22%3CBR%20%2F%3E%3CBR%20%2F%3Ewhere%20you%20need%20to%20specify%20the%20DistinguishedName%20of%20the%20user.%20If%20you%20prefer%20using%20Azure%20AD%20cmdlets%3A%3CBR%20%2F%3E%3CBR%20%2F%3EGet-AzureADUser%20-ObjectId%2058ab2b38-818c-4b85-8871-c9766cb4791b%20%7C%20Get-AzureADUserMembership%3CBR%20%2F%3E%3CBR%20%2F%3EOr%20better%20yet%20use%20Graph%3A%20%3CA%20href%3D%22https%3A%2F%2Fwww.michev.info%2FBlog%2FPost%2F2331%2Fgraph-api-adds-support-for-transitive-membership-queries%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fwww.michev.info%2FBlog%2FPost%2F2331%2Fgraph-api-adds-support-for-transitive-membership-queries%3C%2FA%3E%3C%2FLINGO-BODY%3E
New Contributor

 

My question is, does a cmdlet exist that does the equivalent function of Get-ADPrincipalGroupMembership for M365 or AzureAD, and if not is there a way to achieve a similar functionality without enumerating and comparing every single group in a tenant.

 

I administrate a large number of Microsoft 365 tenants as well as local Active Directory for many companies. As part of this I frequently have to add/move/change user accounts. I have automated a fair amount of these changes via PowerShell with the Msol and ExchangeOnline modules. I have run into a road block however with updating a single user's group memberships. For on-premise AD, there exists the Get-ADPrincipalGroupMembership cmdlet, which allows me to specify a user and then returns all groups they are part of. I want to do the same thing with M365 and groups of all types (distribution, security, M365, etc.) but have been unable to find a cmdlet in any module that can do this.

 

I have looked at using the Get-MsolGroups and the Get-UnifiedGroups cmdlets to enumerate the entire tenant's groups to an array, then use Get-MsolGroupMember and the Get-UnifiedGroupLinks to run a comparison of every single member of every group against the user I am looking for. This method is overly complex, and drastically increases program runtime as it scans through many thousands of entries just to find the 5 or 10 I'm looking for.

 

I know this is possible at least in some sense, because both the AzureAD and the general M365 admin center GUI's are able to instantly pull up all of a user's group memberships when looking at the account. It may just be Microsoft has not yet built/made available a PowerShell cmdlet that utilizes this functionality.

 

Any insight would be appreciated!

 

Thanks

2 Replies
best response confirmed by ndubs (New Contributor)
Solution
For Exchange Online, use this:

Get-Recipient -Filter "Members -eq 'CN=user,OU=domain.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=EURPR03A001,DC=prod,DC=outlook,DC=com'"

where you need to specify the DistinguishedName of the user. If you prefer using Azure AD cmdlets:

Get-AzureADUser -ObjectId 58ab2b38-818c-4b85-8871-c9766cb4791b | Get-AzureADUserMembership

Or better yet use Graph: https://www.michev.info/Blog/Post/2331/graph-api-adds-support-for-transitive-membership-queries

@Vasil MichevPerfect, thank you so much. Not sure how I missed the Get-AzureADUserMembership cmdlet, but it was exactly what I was looking for.