How to get Entra ID directory role members using Microsoft Graph PowerShell

The Get-MgDirectoryRoleMember cmdlet retrieves members assigned to a specific directory role in Microsoft Entra ID (previously Azure AD). This helps you audit and manage user and service principal assignments to administrative roles in your tenant.

Get directory role members using Microsoft Graph PowerShell

Prerequisites

• Before using the cmdlet, ensure that the Microsoft Graph PowerShell module is installed. If not, install it using this PowerShell command:
  Copy Install-Module Microsoft.Graph -Scope CurrentUser
• Also, use the following PowerShell command to connect to Microsoft Graph with the required permissions (e.g., Directory.Read.All or RoleManagement.Read.Directory):
  Copy Connect-MgGraph -Scopes "Directory.Read.All"

Using the Get-MgDirectoryRoleMember cmdlet

Run the following Graph PowerShell command below to list all members of a directory role. Replace <role-id> with the object ID of the directory role:

Examples

Example 1: Get all members of the Global Administrator role

This Graph PowerShell command lists all users and service principals assigned to the specified role:

Example 2: Retrieve up to 10 members of a custom role

This Graph PowerShell command limits the output to only 10 members:

Example 3: List members and display only displayName and userPrincipalName

This Graph PowerShell command filters the output to show only key properties for each member:

Supported parameters

The following are some essential parameters that can be used along with the Get-MgDirectoryRoleMember command:

Limitations of using Microsoft Graph PowerShell to get directory role members

• PowerShell commands can get complicated with different use cases and scenarios.
• IT admins can spend a lot of time debugging errors, which in turn negatively impacts productivity.
• Delegation can get tricky since technicians require elevated permissions.