Get-EntraGroupMember

Module:

Microsoft.Entra.Groups Module v1.3

Gets a member of a group.

Get-EntraGroupMember

 -GroupId <String>
 [-All]
 [-Top <Int32>]
 [-Property <String[]>]
 [<CommonParameters>]

The Get-EntraGroupMember cmdlet gets a member of a group in Microsoft Entra ID. Specify the GroupId parameter to get a member of a group.

In delegated scenarios, the signed-in user must have a supported Microsoft Entra role or a custom role with one of the following permissions: microsoft.directory/groups/members/read, microsoft.directory/groups/members/limitedRead, or microsoft.directory/groups/hiddenMembers/read (for hidden members). The following least privileged roles support this operation:

• Group owners
• "Member" users
• "Guest" users (with limited read permissions)
• Directory Readers
• Directory Writers
• Groups Administrator
• User Administrator (includes hidden members)
• Exchange Administrator (includes hidden members)
• SharePoint Administrator (includes hidden members)
• Intune Administrator (includes hidden members)
• Teams Administrator (includes hidden members)
• Viva Engage Administrator (includes hidden members)

To list members of a hidden group, the Member.Read.Hidden permission is also required.

Connect-Entra -Scopes 'GroupMember.Read.All'
$group = Get-EntraGroup -Filter "DisplayName eq 'Sales and Marketing'"
Get-EntraGroup -GroupId $group.Id | Get-EntraGroupMember | Select-Object Id, DisplayName, '@odata.type'

Id DisplayName @odata.type
------------------------------------ ----------------- -------------------------------
dddddddd-3333-4444-5555-eeeeeeeeeeee Sawyer Miller #microsoft.graph.user
eeeeeeee-4444-5555-6666-ffffffffffff Alex Wilber #microsoft.graph.user
aaaaaaaa-6666-7777-8888-bbbbbbbbbbbb My Application #microsoft.graph.servicePrincipal
cccccccc-8888-9999-0000-dddddddddddd Contoso Group #microsoft.graph.group

This example retrieves the members of a specified group by its GroupId and selects only the Id, DisplayName and @odata.type properties for each member.

• -GroupId specifies the ID of a group.

Connect-Entra -Scopes 'GroupMember.Read.All'
$group = Get-EntraGroup -Filter "DisplayName eq 'Sales and Marketing'"
Get-EntraGroupMember -GroupId $group.Id -Top 2 | Select-Object Id, DisplayName, '@odata.type'

Id DisplayName @odata.type
------------------------------------ ----------------- -------------------------------
dddddddd-3333-4444-5555-eeeeeeeeeeee Sawyer Miller #microsoft.graph.user
aaaaaaaa-6666-7777-8888-bbbbbbbbbbbb My Application #microsoft.graph.servicePrincipal

This example demonstrates how to retrieve top two groups from Microsoft Entra ID. You can use -Limit as an alias for -Top.

• -GroupId specifies the ID of a group.

Connect-Entra -Scopes 'GroupMember.Read.All'
$group = Get-EntraGroup -Filter "DisplayName eq 'Sales and Marketing'"
Get-EntraGroupMember -GroupId $group.Id -All | Select-Object Id, DisplayName, '@odata.type'

Id DisplayName @odata.type
------------------------------------ ----------------- -------------------------------
dddddddd-3333-4444-5555-eeeeeeeeeeee Sawyer Miller #microsoft.graph.user
eeeeeeee-4444-5555-6666-ffffffffffff Alex Wilber #microsoft.graph.user
aaaaaaaa-6666-7777-8888-bbbbbbbbbbbb My Application #microsoft.graph.servicePrincipal
cccccccc-8888-9999-0000-dddddddddddd Contoso Group #microsoft.graph.group

This example retrieves all members within a group by group ID.

• -GroupId specifies the ID of a group.

Connect-Entra -Scopes 'GroupMember.Read.All'
$group = Get-EntraGroup -Filter "DisplayName eq 'Sales and Marketing'"
Get-EntraGroupMember -GroupId $group.Id | Select-Object Id, DisplayName, '@odata.type'

Id DisplayName @odata.type
------------------------------------ ----------------- -------------------------------
dddddddd-3333-4444-5555-eeeeeeeeeeee Sawyer Miller #microsoft.graph.user
eeeeeeee-4444-5555-6666-ffffffffffff Alex Wilber #microsoft.graph.user
aaaaaaaa-6666-7777-8888-bbbbbbbbbbbb My Application #microsoft.graph.servicePrincipal
cccccccc-8888-9999-0000-dddddddddddd Contoso Group #microsoft.graph.group

This example demonstrates how to retrieve group member by ID.

• -GroupId Specifies the ID of a group.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.