As an admin, you might have used a group membership report or distribution group members report to identify groups and their members. But there are few situations in which you want to list users and their groups. If you are one of them, then this blog is for you! 

Why Administrator Need to Know Groups a User is Member Of? 

1. It is essential to know whether the employees are only in the right groups and getting all group information they are associated with.  
2. Adding, removing, and managing the users to the groups are the critical tasks of the administrators. Having the “user member of” report along with “user owner of” report readily, the admin can provide approval, reject, or limited access to the requestor.  
3. Based on the user direct membership report, admins maintain the security of the groups among different departments.  
4. With this report, the admin can retain all groups a disabled user is a member of. This will help the admin in granting or removing the group access efficiently. 

How to View the List of Groups a User is Member Of? 

Viewing in User Profile: By clicking the user’s profile in the Microsoft 365 admin center, under the ‘Groups‘, you can see the list of group names the user is associated with. Same way, in the AzureAD portal, on clicking the ‘Groups’ under ‘Users’, you can see the user membership details. Using the user profile will not be suitable while we need to process huge users. 

Using PowerShell: Get-AzureADUserMembership will return the list of groups the user is a member of. But the Azure AD PowerShell module is under deprecation, you need to switch from Azure AD PowerShell module to MS Graph PowerShell cmdlets. However, to get a nicely formatted report, administrators need to use multiple cmdlets. It will be time and effort-consuming to get a detailed report with numerous filtering options.  

So, we designed the PowerShell script to support the administrators in saving time, effort and deliver a reliable user membership report.  

Script Highlights:

1. Generates 12 different user membership reports.
2. The script uses MS Graph PowerShell and installs MS Graph PowerShell SDK (if not installed already) upon your confirmation. 
3. It can be executed with certificate-based authentication (CBA) too.
4. Supports both MFA and Non-MFA accounts.  
5. Allow to use filter to get guest users and their membership alone. 
6. Allow to use filter to get disabled users’ membership. 
7. Helps to identify users who are not member of any groups. 
8. Exports report result to CSV.
9. The script is scheduler-friendly. 

Download Script: UserMembershipReport.ps1

Sample Output: 

The exported user membership report looks similar to the below screenshot.

The exported report has the attributes like, Display Name, Email Address, Group Name(s), License Status, Account Status, Department, and Roles. 

Note: The report doesn’t include dynamic distribution group members details, as it requires different modules and cmdlets. 

Export AzureAD Users’ Membership Report – Script Execution

The script gives the aggregated report of the users’ membership details to the admins. At the end of the execution, you will be notified with the retrieved user count for the specified condition. You can choose any one of the below methods based on your requirement.

Find All the Office 365 Groups a User is a Member Of 

This script’s standard format will get the list of groups an Office 365 user is a member of and export them to the CSV file.  

.\UserMembershipReport.ps1

The above format is used for the both non-MFA and MFA-enabled accounts.  

Get Group Membership for a List of Users (Input through CSV) 

Based on the organizations’ nature, the employees are shifted to various departments. Technically, these employees’ department-specific groups access should be activated or terminated as soon as they join or leave the department. So, the privacy of the group data is guaranteed. With the list of employees falling under this category, the admin will identify whether the assigned groups to the user is valid or not and proceed with adding or removing them from the group.  

.\UserMembershipReport.ps1 -UsersIdentityFile {filepath}

The administrator can provide the UserPrincipalName or User ObjectId as the input (reference below). 

Sample Input: 

Note: As crucial as finding the user’s membership, auditing group membership also holds equal importance.

Find Guest User Account and their Membership Details 

The admins invite guest users to start the collaboration with the organization. Using the report, the admin works on identifying the guest users’ group details and includes them to specific groups that promote organization growth. Also, with reference to this report, administrators can remove guest account from specific group(s).  

.\UserMembershipReport.ps1 -GuestUsersOnly

The GuestUsersOnly param helps to get guest user and their group membership details. 

Additionally, you can visit the Guest User Report blog to get more detailed guest user report.

Get the Disabled Users’ Membership Report 

Most organizations maintain the former employee’s data in the name of disabled users. Their data are retained for future references. Having this report readily, the administrators can remove group membership of disabled accounts.  

.\UserMembershipReport.ps1 -DisabledUsersOnly

By adding the ‘DisabledUserOnly’ param, the admin can get the group membership of disabled user accounts.

Retrieve Office 365 Users Who are not a Member of Any Group 

In the organization, there will be newly joined employees. So, they will not be added to any groups. Using our report, the administrators will identify them and add them to the necessary groups. Also, there will be restricted users like internship students, contract employees, blocked or unauthorized users, and non-staffs. They will not be included in any groups related to the organizations as their access scope is minimal. Using our report, administrators make sure they are not into any organizational groups.  

.\UserMembershipReport.ps1 -UsersNotinAnyGroup

Running script with ‘UsersNotinAnyGroup’ switch, you will get users with no group membership. 

Execute the Script with Certificate (Scheduler-friendly):

To run the script unattended, you may consider using certificates for authentication. Depending on your needs, you can either create a self-signed certificate, which is more budget-friendly, or utilize a Certificate Authority (CA) certificate.

To execute the script with Certificate-based Authentication (CBA), you can include the TenantId, ClientId, and CertificateThumbprint parameters in the specified format.

.\UserMembershipReport.ps1 -TenantId <TenantId> -ClientId <ClientId> -CertificateThumbprint <Certthumbprint>

Get Office 365 Groups a User is Member of Report – More Use Cases 

We provide you with the options to try the different criteria combinations when looking for satisfactory and direct reports.  

To get the list of group membership details for the disabled guest users:  

.\UserMembershipReport.ps1 -GuestUsersOnly -DisabledUsersOnly

To get the disabled guest users who are not a member of any group:  

.\UserMembershipReport.ps1 -UsersNotinAnyGroup -DisabledUsersOnly -GuestUsersOnly

To retrieve the group membership for the guest users available in the input file  

.\UserMembershipReport.ps1 -UsersIdentityFile {filepath} -GuestUsersOnly

To retrieve the group membership for the disabled users available in the input file 

.\UserMembershipReport.ps1 -UsersIdentityFile {filepath} -DisabledUsersOnly

To list the group details for the disabled guest users from the specified users:  

.\UserMembershipReport.ps1 -UsersIdentityFile {filepath} -GuestUsersOnly –DisabledUsersOnly

To filter out disabled guest users who are not member of any group from the list of users (or) try as you wish 

.\UserMembershipReport.ps1 -UsersIdentityFile {filepath} -UsersNotinAnyGroup -GuestUsersOnly -DisabledUsersOnly

Get More Detailed User Membership Report:

If you are tired of manually executing the PowerShell script and looking for the easiest way to generate Microsoft 365 user reports, then take a look at Microsoft 365 reporting tool by AdminDroid.

AdminDroid provides the following users’ group membership report,

• User membership report – Shows all the Office 365 groups a user is member of.
• Contact membership report – Lists all the groups the contact is member of.
• External users’ group membership report – Shows external users and their groups.
• Admin role group report – Lists all the administrators along with their role group.

Besides, AdminDroid Offers over 120+ reports and a handful of dashboards completely for free. It includes reports on Users, Licenses, Groups, Group Members, Devices, Login Activities, Password Changes, License Changes, and more. You can do customization, scheduling, and exporting. This can help you to stay on top of critical Azure AD management tasks, such as monitoring user activity, tracking license usage, and managing group memberships.

Additionally, AdminDroid provides 1800+ pre-built reports and 30+ visually appealing smart dashboards on various Office 365 services like Azure AD, Exchange Online, SharePoint Online, Microsoft Teams, OneDrive for Business, Skype for Business, Yammer, General Office 365 reports, and security reports.

Download Free Office 365 reporting tool by AdminDroid to manage your Azure AD environment effectively.

Conclusion:

The administrators are often requested to perform user membership changes by adding or removing users from the groups. Proper maintenances of the user membership will give the benefits of the following key purpose.

• Sharing group information with the right users,
• secure data from the random audience,
• Keep restricted users away from the group

We hope our blog will help the admins to meet their needs effectively and smartly.  

The post Export Office 365 Groups a User is Member Of Using PowerShell appeared first on Office 365 Reports.