How to report all security group members of an Active Directory organizational unit

Managing security groups in an Active Directory organizational unit is pretty straightforward with built-in tools, but each has its limitations and a learning curve. Whether you use ADUC, the Microsoft 365 admin centers, or PowerShell, each gives you a different mix of control, ease, and complexity.

In Active Directory Users and Computers (ADUC), you can filter groups and export names, but not members, and you must open groups one by one; no nested resolution, and no export schema that auditors want.

Just head to your Active Directory organizational unit and:

1. Apply a filter to list only groups in that OU.
2. Look up each group’s properties manually to get its members.

This process can become tedious if your organizational unit includes many groups or nested structures.

If you’re just tracking security groups that sync to Entra from your Active Directory organizational unit, the Microsoft 365 admin centers can help.

However, expect a few caveats:

• Both the general Microsoft 365 admin center (A) and the Entra admin center (B) show a list of security groups, but do not include OU information.
• Only the Entra admin center lets you filter to show syncing security groups—but these filters skip mail-enabled security groups.
• In both admin centers, you must open a group to view its members.

Here are simple PowerShell cmdlets for listing security groups in the OU “Accounts” and each group’s members, with results shown in the image that follows:

1. List all groups in the OU: Get-ADGroup -Filter * -SearchBase “OU=Accounts,DC=company,DC=com”
2. List a group’s members: Get-ADGroupMember -Identity group.ID

For nested groups, see more parameter examples on Microsoft’s docs page .

Not everyone is comfortable using PowerShell, or simply doesn’t have the time to script. Lucky for them, sapio365 is an excellent alternative tool, as you’ll see in the next section.

Let’s explore how sapio365 makes reporting on your Active Directory organizational unit completely painless. Gain a comprehensive view of all cloud and on-premises groups within your Active Directory organizational unit, including their associated properties. Filter just what you need and export member information in a snap.

sapio365 displays both cloud and on-premises groups in a unique way by reconciling 100 group properties in Entra and ALL group properties in Active Directory for each synced group. This comprehensive view enables you to quickly locate the information you’re looking for, including the sync status of groups, group type, OU, and other relevant details.

sapio365’s filters make it easy to zoom in on security groups from your chosen OU. Save the perfect view for next time.

Here are 3 easy steps in sapio365 to list all the security groups in the OU ‘Accounts.’

The screenshot illustrates these steps in action:

1. Filter security groups on the group type.
2. Filter for the specific OU.
3. Save this custom view to use for recurrent reporting on that OU.

Once you’ve filtered the right OU groups in sapio365, simply:

1. Select all groups and get the list of each group’s on-prem members.
2. You can even expand any nested groups there to get the complete picture of all group members.
3. (optional) Save the view or export it to an Excel file for a ready-to-send report.

I’ll show you shortcuts later to the views you’ve saved and how to use them in automated reports.

Finally, if your group memberships need fixing along the way, you can remove or add members across various groups in Active Directory in just one click, and you can preview everything before saving (highlighted in green in the image below).

If you want regular reports for your Active Directory organizational unit, sapio365 lets you automate emails and scheduled reports based on your saved views.

The following image demonstrates sapio365’s reporting options:

1. Generate or email real-time group membership data with one click.
2. Schedule sapio365 to email the report every week.

As you can see, sapio365 makes group reporting (and fixing!) much easier. Here’s a quick comparison table between Microsoft native tools and sapio365.

How to Report and Reduce Microsoft 365 License Cost for Unused Licenses

How to easily audit Microsoft Office 365 license assignments in no time!

Removing Weak Microsoft 365 Multi-Factor Authentication (MFA) Methods

Important information you want to know about Microsoft Office 365 license assignment dates and audit logs