Azure AD PowerShell Equivalent to Get-ADPrincipalGroupMembership
Question details
The administrator needs to retrieve all Azure AD group memberships for a specific user without querying every single group in the Microsoft 365 tenant.
- Product
- Azure AD / Microsoft 365
- Device & OS
- not provided
- Scenario
- Administering user permissions and retrieving cloud-based group memberships using PowerShell.
- Observed behavior
- Looking for the cloud equivalent to the on-premise Get-ADPrincipalGroupMembership PowerShell cmdlet.
Ensure you have the necessary administrative privileges in Azure Active Directory (Microsoft Entra ID) and have installed the Microsoft Graph PowerShell SDK on your system.
Use Microsoft Graph PowerShell (Recommended)
Microsoft Graph is the modern, recommended approach for managing Microsoft Entra ID (Azure AD) resources, replacing legacy modules.
Since the AzureAD PowerShell module is deprecated, Microsoft strongly recommends using the Microsoft Graph PowerShell SDK. The direct equivalent for retrieving a user's group memberships is the Get-MgUserMemberOf cmdlet.
Open your PowerShell console as an Administrator and run 'Install-Module Microsoft.Graph' to install the necessary SDK.
Run the command 'Connect-MgGraph -Scopes "User.Read.All", "Group.Read.All"' and sign in with your administrative credentials.
Use the command 'Get-MgUserMemberOf -UserId <UserObjectId>' (replacing <UserObjectId> with the target user's ID or UPN) to list all groups the user belongs to.
Use the AzureAD PowerShell Module
A legacy method for administrators who are still maintaining older scripts using the AzureAD PowerShell module.
Looking for a Lightweight Office Suite for Your Business?
While managing Microsoft 365 environments requires specialized PowerShell knowledge and expensive subscriptions, your team's daily document tasks shouldn't be complicated or costly. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office, reducing IT deployment overhead and licensing expenses.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for your organization's operating system.
- 2. Install WPS Office: Run the downloaded installer and follow the on-screen instructions for a fast, hassle-free setup.
- 3. Open Existing Documents: Launch WPS Office and open your existing Microsoft Office files with perfect formatting retention.
Frequently Asked Questions
Why is Get-ADPrincipalGroupMembership not working in Azure AD?
Get-ADPrincipalGroupMembership is an Active Directory module cmdlet specifically designed for on-premises AD environments. Azure AD (now Microsoft Entra ID) uses entirely different APIs, requiring modules like Microsoft Graph PowerShell to retrieve similar data.
How do I find a user's Object ID in Azure AD?
You can find a user's Object ID by navigating to the Microsoft Entra admin center, selecting 'Users', and clicking on the specific user's profile. Alternatively, you can use the 'Get-MgUser -UserId user@domain.com' PowerShell command to retrieve the ID programmatically.
Can I get nested group memberships in Azure AD PowerShell?
Unlike the on-premise Get-ADPrincipalGroupMembership which has a '-Recursive' parameter, the cloud equivalent Get-MgUserMemberOf does not natively resolve nested memberships in a single command. You will need to write a script or use transitive membership API endpoints via Microsoft Graph to resolve nested groups.
