PowerShell - Get members of multiple groups

[omc_st2022]

Hi,

I'm trying to get the members of multiple groups listed is a CSV file.

Here is an example of a script I've been trying to use to achieve the above:

$csv = Import-Csv "C:\Temp\Groups\testgroups.csv"
foreach ($line in $csv){
$groupname = $line.GroupName
$objectid = (Get-AzureADGroup | Where-Object {$_.DisplayName -eq $groupname}).ObjectId
Get-AzureADGroupMember -ObjectId $objectid | select DisplayName,UserPrincipalName | Export-Csv -Path "C:\Temp\Groups\testmembers.csv" -NoTypeInformation -Append
}

However, this script fails with the following error:
  

Get-AzureADGroupMember : Cannot bind argument to parameter 'ObjectId' because it is null.
At line:4 char:38
+ Get-AzureADGroupMember -ObjectId $objectid | select DisplayName,U ...
+ ~~~~~~~~~
+ CategoryInfo : InvalidData: (:) [Get-AzureADGroupMember], ParameterBindingValidationException
+ FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.Open.AzureAD16.PowerShell.GetGroupMembers

  
I'm assuming its failing on line 4 of the script, and not pulling the objectid for each group?

Any help would be greatly appreciated.
 
Thanks

[#2]

After starting the script and receiving the error, how are the $line and $groupname variables at that moment?

[#3]

@omc_st2022 

Something's not lining up with the data held in the CSV and the Get-AzureADGroup command on line 4.

Essentially, line 4 is not producing any matching groups, which is the only way your $objectid variable can end up being $null.

Maybe the wrong names are in the CSV. Maybe there's no header or the header is not named GroupName - I have no idea as we can't see any data from your CSV file.

Anyhow, if you solve whatever the mismatch is, you'll solve the ObjectId is $null error.

Cheers,

Lain

[#4]

@Harm_Veenstra Thanks for the reply, after the script is run $groupname is showing the last group name in the CSV, same with $line.

My csv looks like this:

GroupName

TESTGroup1

TESTGroup2

[#5]

Thanks Lain, appreciate your input. I'm no PS expert, I've posted my CSV layout, hopefully I'm not doing something silly here. BTW my PS version is 5.1.19041.1682 if that helps. Cheers

[#6]

Not sure why you're using CSV with one column ;) a get-content of a txt file containing one line per group is the same... If you run this manually, what's the output?

(Get-AzureADGroup | Where-Object {$_.DisplayName -eq $testgroup1}

[#7]

Stripping things right back to basics, taking variables and client-side filtering out completely, can you actually see one of those groups through running a basic command like this:

Get-AzureADGroup -Filter "displayName eq 'TESTGroup1'";

Cheers,

Lain 

[#8]

I did actually try this with a txt file listing the group names without a header, and got the same result.

If I run the following command:

(Get-AzureADGroup | Where-Object {$_.DisplayName -eq $groupname})

I get nothing, the cursor just jumps down to the next line. Its like this line is failing to obtain the objectid and append it to the variable, then the following line (Get-AzureADGroupMember -ObjectId $objectid) is failing as $objectid is null.

[#9]

@LainRobertson If I run that command it returns the group objectid, display name and description of the group correctly.

So due to Get-AzureADGroupMember not supporting -identity GroupName (like Get-ADGroupMember does), we're having to locate the objectid for each group and that's the bit i'm stuck at? It's like somethings wonky with the syntax in line 4, nullifying the $objectid variable:

$objectid = (Get-AzureADGroup | Where-Object {$_.DisplayName -eq $groupname}).ObjectId

[#10]

Ran your script in my test tenant with only sg-finance as group in the csv, it just works?!

C:\Users\HarmV> $csv = Import-Csv "C:\Temp\Groups\testgroups.csv"
C:\Users\HarmV> $csv

GroupName
---------
sg-finance

C:\Users\HarmV> foreach ($line in $csv){
>> $groupname = $line.GroupName
>> $objectid = (Get-AzureADGroup | Where-Object {$_.DisplayName -eq $groupname}).ObjectId
>> Get-AzureADGroupMember -ObjectId $objectid | select DisplayName,UserPrincipalName | Export-Csv -Path "C:\Temp\Groups\testmembers.csv" -NoTypeInformation -Append
>> }
C:\Users\HarmV> cat C:\temp\groups\testmembers.csv
"DisplayName","UserPrincipalName"
"Pradeep Gupta","email address removed for privacy reasons"
"Debra Berger","email address removed for privacy reasons"
"Megan Bowen","email address removed for privacy reasons"
"Diego Siciliani","email address removed for privacy reasons"

Is the displayname of your group different than the groupname?

[#11]

@omc_st2022 

Bear with me as there's a method to this.

If you indeed got a result from:

Get-AzureADGroup -Filter "displayName eq 'TESTGroup1'";

What do you get if you run this?

Get-AzureADGroup -Filter "displayName eq 'TESTGroup1'" | Get-AzureADGroupMember;

You should see the members - assuming the group has any - such as in the following example.

If you do indeed see members listed then the problem is exclusively within your CSV data or the client-side filtering.

As a side-note on ObjectId (or simply "id" as it's been re-branded in more recent Graph-based modules), every single object of every kind within Azure AD has such a GUID - it's not possible to not have one. Even a public IP address not yet used a resource is still an object that has its own objectId.

Similarly, all Azure PowerShell modules return it - be it under the "objectId" or "id" branding. There is zero chance that the value is somehow missing.

Cheers,

Lain

[#12 · Accepted solution]

@omc_st2022 

Let me put some of the information you've provided together into a working example.

Here's our CSV file layout:

Here's our script for pulling the members:

(Import-Csv -Path "C:\Temp\Groups\testgroups.csv").GroupName |
    ForEach-Object { Get-AzureADGroup -Filter "displayName eq '$_'" } |
        ForEach-Object {
            $Group = $_;
            $Group | Get-AzureADGroupMember | Select-Object @{n="GroupName"; e = { $Group.DisplayName; }}, ObjectId, UserPrincipalName, DisplayName;
        }

And here's the results (using my own example group names):

Cheers,

Lain

[#13]

@LainRobertson Goodness me your script does work! It's structured different to what I was using, but it works whereas the original script I was trying to run does not. I guess my skills are still primitive, I shall reside in the temple and practice my PowerShell-Fu some more. 

Huge thanks to you and Harm_Veenstra for helping me out with this, its nice to know people are out here offering free help to those in need. 

All the best, cheers