Get-EntraUserMembership

Module:

Microsoft.Entra.Users Module v1.3

Get user memberships.

Get-EntraUserMembership

 -UserId <String>
 [-All]
 [-Top <Int32>]
 [-Property <String[]>]
 [<CommonParameters>]

The Get-EntraUserMembership cmdlet gets user memberships in Microsoft Entra ID.

Connect-Entra -Scopes 'User.Read'
Get-EntraUserMembership -UserId 'SawyerM@contoso.com' |
Select-Object Id, displayName, createdDateTime, '@odata.type' |
Format-Table -AutoSize

Id displayName createdDateTime @odata.type
-- ----------- --------------- -----------
00aa00aa-bb11-cc22-dd33-44ee44ee44ee Contoso 2024-10-06T08:49:16Z #microsoft.graph.group
22cc22cc-dd33-ee44-ff55-66aa66aa66aa Contoso marketing 2024-10-07T01:17:28Z #microsoft.graph.group
55ff55ff-aa66-bb77-cc88-99dd99dd99dd Pacific Admin Unit #microsoft.graph.administrativeUnit

This example demonstrates how to retrieve user memberships in Microsoft Entra ID.

Connect-Entra -Scopes 'User.Read'
Get-EntraUserMembership -UserId 'SawyerM@contoso.com' -All |
Select-Object Id, displayName, createdDateTime, '@odata.type' |
Format-Table -AutoSize

Id displayName createdDateTime @odata.type
-- ----------- --------------- -----------
00aa00aa-bb11-cc22-dd33-44ee44ee44ee Contoso 2024-10-06T08:49:16Z #microsoft.graph.group
22cc22cc-dd33-ee44-ff55-66aa66aa66aa Contoso marketing 2024-10-07T01:17:28Z #microsoft.graph.group
55ff55ff-aa66-bb77-cc88-99dd99dd99dd Pacific Admin Unit #microsoft.graph.administrativeUnit

This example demonstrates how to retrieve users all memberships in Microsoft Entra ID.

Connect-Entra -Scopes 'User.Read'
Get-EntraUserMembership -UserId 'SawyerM@contoso.com' -Top 3 |
Select-Object Id, displayName, createdDateTime, '@odata.type' |
Format-Table -AutoSize

Id displayName createdDateTime @odata.type
-- ----------- --------------- -----------
00aa00aa-bb11-cc22-dd33-44ee44ee44ee Contoso 2024-10-06T08:49:16Z #microsoft.graph.group
22cc22cc-dd33-ee44-ff55-66aa66aa66aa Contoso marketing 2024-10-07T01:17:28Z #microsoft.graph.group
55ff55ff-aa66-bb77-cc88-99dd99dd99dd Pacific Admin Unit #microsoft.graph.administrativeUnit

This example demonstrates how to retrieve users top three memberships in Microsoft Entra ID. You can use -Limit as an alias for -Top.

Connect-Entra -Scopes 'User.Read.All'
Get-EntraUserMembership -UserId 'SawyerM@contoso.com' |
Where-Object { $_.'@odata.type' -eq '#microsoft.graph.group' } |
Select-Object Id, displayName, createdDateTime, groupTypes, securityEnabled, visibility, '@odata.type' |
Format-Table -AutoSize

Id displayName createdDateTime groupTypes securityEnabled visibility @odata.type
-- ----------- --------------- ---------- --------------- ---------- -----------
00aa00aa-bb11-cc22-dd33-44ee44ee44ee Contoso 2024-10-06T08:49:16Z {Unified} False Public #microsoft.graph.group
11bb11bb-cc22-dd33-ee44-55ff55ff55ff Mark 8 Project Team 2024-10-07T00:43:59Z {Unified} True Public #microsoft.graph.group
22cc22cc-dd33-ee44-ff55-66aa66aa66aa Leadership 2024-10-07T00:43:53Z {Unified} True Private #microsoft.graph.group

This example retrieves the groups a user belongs to. You can also use Get-EntraUserGroup for the same result.

Connect-Entra -Scopes 'User.Read.All'
Get-EntraUserMembership -UserId 'SawyerM@contoso.com' |
Where-Object { $_.'@odata.type' -eq '#microsoft.graph.directoryRole' } |
Select-Object Id, displayName, Description, RoleTemplateId, '@odata.type' |
Format-Table -AutoSize

Id DisplayName Description RoleTemplateId @odata.type
-- ----------- ----------- -------------- -----------
bbbbbbbb-1111-2222-3333-ccccccccccc Helpdesk Administrator Can reset passwords for non-administrators and Helpdesk Administrators. 729827e3-9c14-49f7-bb1b-9608f156bbb8 #microsoft.graph.directoryRole
dddddddd-3333-4444-5555-eeeeeeeeeeee Guest Inviter Can invite guest users independent of the 'members can invite guests' setting. 95e79109-95c0-4d8e-aee3-d01accf2d47b #microsoft.graph.directoryRole

This example lists a user's assigned directory roles. You can also use Get-EntraUserRole for the same result.

Connect-Entra -Scopes 'User.Read.All'
Get-EntraUserMembership -UserId 'SawyerM@contoso.com' |
Where-Object { $_.'@odata.type' -eq '#microsoft.graph.administrativeUnit' } |
Select-Object Id, displayName, Description, MembershipRule, MembershipType, Visibility |
Format-Table -AutoSize

Id DisplayName Description MembershipRule MembershipType Visibility
-- ----------- ----------- -------------- -------------- ----------
dddddddd-3333-4444-5555-eeeeeeeeeeee Pacific Admin Unit Pacific Administrative Unit
aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb Engineering Administrative Unit Engineering Admin Unit

This example lists a user's administrative units. You can also use Get-EntraUserAdministrativeUnit for the same result.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.