How to get Microsoft Office 365 synced users’ group memberships with and without PowerShell

Looking up a user’s groups in the general admin center is straightforward. However, you’ll note very quickly that there is important basic information missing. For example, you won’t know which groups are security groups, Microsoft 365 groups, Teams, or distribution groups.

And while you can add or remove group memberships from this view, you won’t be able to select and copy the list for a simple report!

In the past, you were able to rely on using the cmdlet Get-AzureADUserMembership with the Azure Active Directory PowerShell module to get a list of a user’s group memberships. These days, Microsoft is deprecating this module and encouraging PowerShell-yielding admins to use the Microsoft Graph PowerShell module.

For example, to list a user’s direct group memberships, you can connect to the Microsoft Graph module with the required permission scopes:

Connect-MgGraph -Scopes user.read.all, directory.read.all

Then query a user’s group memberships with the Get-MgUserMemberOfAsGroup cmdlet. For example:

Get-MgUserMemberOfAsGroup -UserId AdeleV@sygx2.onmicrosoft.com

Looking up group memberships from a list of users is child’s play with sapio365 whether there’s ten users or thousands! You can even use an Excel file to select or filter for everyone on your list without missing anyone. If there’s a mismatch due to bad data in the file, sapio365 will save a list for you so that you can process those accounts later.

Another example is if you’re looking for a membership report on users who meet specific criteria (ex. users in the sales department) because the list changes all the time. sapio365 can isolate these users automatically based on the custom view you create.

Starting with the full list of users, whether you select them manually or by applying a filter (the department field is used here), you can isolate your users with a few clicks.

Save this view if you want to look up these users again at later time.

Once you’ve isolated your users, you’re just a click away from getting their group memberships. For each user, you’ll see important information on the groups they belong to:

• What type of group it is
• If the membership is direct or not
• If the group is synced from on-premises Active Directory (hybrid tenant)

You can also enrich this view with more group and user properties that can help in making decisions. For example, you can include users’ job title, their last sign-in date and their current sign-in status. And for groups, you can show if they are used for license assignments, whether they are dynamic and their creation date (see image below).

Now that you’ve retrieved everyone’s group memberships, you just need to select the groups you’d like to remove the users from, again, with just one click.

If you’re not sure when you apply your changes, don’t worry! You’ll get to preview the changes—and undo them—before committing them.

When compared with the admin portal or using PowerShell scripts, reporting on users’ group memberships is easy to do with sapio365. This admin tool gives you a full view of all your users in one place. With this view, you can drill down into the details you need, sort and organize the information using the filters it offers. And for added security, you can preview your changes before you apply them. Once you have the data organized the way you want it, you can save your customized views for the next time you need to run the same reports or schedule the report to run however often you want.

sapio365 has a lot of capabilities that can transform the way you manage Microsoft 365 so why not discover them all with a free trial.

3 easy steps to avoid OneDrive archiving fees

Why having a Microsoft GCC High environment doesn’t limit you to Microsoft Office 365 native admin tools

Your admin bestie has a new look and more features to make your life easier

How to Create an Entra ID Activity Summary Report from Microsoft Office 365 Admin Audit Logs