How to get Microsoft Entra ID users' group memberships using the Get-MgUserMemberOf cmdlet

Getting Microsoft Entra ID user group memberships

Knowing which groups a user is a member of is essential for access control, compliance, and troubleshooting. While Microsoft Graph PowerShell's Get-MgUserMemberOf cmdlet can help retrieve this information, it comes with the usual challenges of scripting—complex syntax, elevated permissions, and limited report formatting options.

Get-MgUserMemberOf cmdlet in Microsoft Graph PowerShell

Prerequisites

Before using the Get-MgUserMemberOf cmdlet:

• Ensure Microsoft Graph PowerShell module is installed. If not, install it using this script:
  Copy Install-Module Microsoft.Graph -Scope CurrentUser
• Connect to Microsoft Graph PowerShell with the required permissions to view group memberships.
  Copy Connect-MgGraph -Scopes "User.Read.All", "Group.Read.All"

Using the Get-MgUserMemberOf cmdlet

This cmdlet lists the groups that a specific user is a direct member of:

Example use cases and scripts

Example 1: List group memberships for a single user

Example 2: Filter group memberships by type (e.g., Security)

Example 3: Export group memberships to CSV

Supported parameters

Limitations of using Graph PowerShell scripts for Microsoft Entra ID reporting

• Requires understanding of nested object properties and type filters.
• No built-in filtering for group types such as Microsoft 365 and security groups, unless scripted manually.
• Reports are plain-text unless manually formatted and exported.
• No built-in scheduling or email alerts.
• Not intuitive for help desk or non-technical users.