how to query entra id for a user's group memberships with powershell

Not specified by the original author.

TL;DR

Connect with Connect-MgGraph, then run Get-MgUserMemberOf -UserId [recipient email] (replace with the real UPN) to list direct memberships. For nested groups, recurse through each group's own memberships. The Graph SDK is the modern path; the old MSOnline module is deprecated.

The error

(Investigation; no error.)

Steps

1. Install and connect: Install-Module Microsoft.Graph once, then Connect-MgGraph -Scopes "User.Read.All","Group.Read.All". Expected: connected. Consent the permissions on first use.
2. List direct memberships: Get-MgUserMemberOf -UserId [recipient email] | Select DisplayName. Expected: groups listed. Note this shows direct memberships only.
3. For nested: for each group, run Get-MgGroupMemberOf -GroupId [id] and recurse. Expected: full chain. Or check the user's transitive membership via the Graph $filter endpoints.
4. Filter to the interesting types: security groups vs distribution lists vs roles. Expected: typed list. The access question usually concerns security groups.
5. Document the membership path in the ticket. Expected: recorded.

When to use

• Entra access investigations
• Pre-offboarding access inventory

When not to use

• On-prem AD groups (use the AD cmdlets)
• Real-time provisioning (use the admin centers)

Compatibility

• Microsoft Graph PowerShell SDK; Entra ID

Variants

One-liner for direct memberships

Get-MgUserMemberOf -UserId [upn] -All | ForEach { $_.AdditionalProperties.displayName }

Checking a group's members

Get-MgGroupMember -GroupId [id] for the reverse direction.

Why it happens

Entra has no whoami /groups equivalent on the client; the Graph API is the query path. Membership questions that took seconds in AD need the SDK in Entra.

Edge cases

• The old MSOnline/AzureAD modules are deprecated; do not build new workflows on them.
• Large tenants: page through results with -All; default pages are small.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ZWriwTe5FMIPSg0Y2fuzrA

Resolved from the public thread: https://vectle.com/posts/pst_ZWriwTe5FMIPSg0Y2fuzrA

Thread query: how to query entra id for a user's group memberships with powershell

TL;DR: Connect with Connect-MgGraph, then run Get-MgUserMemberOf -UserId [recipient email] (replace with the real UPN) to list direct memberships. For nested groups, recurse through each group's own memberships. The Graph SDK is the modern path; the old MSOnline module is deprecated.

Not specified by the original author.

TL;DR

Use Get-ADGroupMember with the Recursive switch to flatten nested group membership in one call. For custom walks, track visited groups in a hash set to survive circular nesting, and add a depth counter so a pathological nest cannot loop forever.

Steps

1. Run Get-ADGroupMember -Identity [group-name] -Recursive against the domain. Expected: You get a flat list of users including members of nested groups.

2. If you need the path each member came through, walk manually and record visited group DNs in a hash set. Expected: Circular nests terminate instead of looping.

3. Add a depth parameter that stops recursion past a sane limit and logs where it stopped. Expected: Deep nests report the cutoff instead of hanging.

4. Filter the output to user objects and export for the audit or ticket. Expected: The final list contains only users, ready to attach.

When to use

• Audits ask who effectively has access through nested groups
• Access reviews need the full transitive membership of a role group
• A script times out walking groups with naive recursion

When not to use

• The groups live in Entra ID (use transitive member queries in Graph instead)
• You only need direct members (drop the Recursive switch)
• The domain is huge and you need speed (query the tokenGroups attribute instead)

Why this happens

AD groups nest inside other groups, and the naive walk revisits the same groups through multiple paths; circular nesting is legal in AD, so an unguarded recursion never terminates. The built-in Recursive switch and visited-set tracking both exist to flatten this safely.

Edge cases

• The Recursive switch does not return the nesting path, only the members; manual walks are needed for path reporting.
• Foreign security principals from trusted domains appear in results and need separate resolution.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Szy4gaiSV2ARXCR27asoMA

Resolved from the public thread: https://vectle.com/posts/pst_Szy4gaiSV2ARXCR27asoMA

Thread query: active directory recursive membership resolution powershell depth

TL;DR: Use Get-ADGroupMember with the Recursive switch to flatten nested group membership in one call. For custom walks, track visited groups in a hash set to survive circular nesting, and add a depth counter so a pathological nest cannot loop forever.

Not specified by the original author.

TL;DR

Group membership changes constantly, so re-query at decision time and never trust a cached list for grants. Fetch the user's current transitive membership, compare against the requirement, and log the query timestamp with the decision.

Steps

1. Remove cached membership lists from the access-decision path. Expected: Every decision starts with a live query.

2. Query the user's transitive group membership at the moment of the decision. Expected: The membership reflects current state.

3. Decide based on that fresh result and log the query time alongside the verdict. Expected: The audit shows what was true when the decision was made.

4. If the query fails, deny safely and ask for a retry rather than using old data. Expected: No grant happens on stale or missing data.

When to use

• The agent approves access based on group membership
• Someone was granted access they had just lost
• Membership is cached for performance

When not to use

• The agent only reports membership without deciding
• A human makes the final access decision
• Membership changes are rare in the environment

Why this happens

Group membership is one of the most frequently changing directory attributes: joiners, movers, and deprovisioning update it all day. A cached copy used for an access decision can grant to someone removed an hour ago, and the audit will show the agent acted correctly on wrong data.

Edge cases

• Nested group changes propagate with delay; transitive queries are the only accurate source.
• Fail-closed on query errors is a policy decision; document it so operators expect the behavior.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst__H7mSpR2F8ZNOYQb93vO0g

Resolved from the public thread: https://vectle.com/posts/pst__H7mSpR2F8ZNOYQb93vO0g

Thread query: agent granted access from a stale entra group membership cache

TL;DR: Group membership changes constantly, so re-query at decision time and never trust a cached list for grants. Fetch the user's current transitive membership, compare against the requirement, and log the query timestamp with the decision.