An admin needs to see the directory objects owned by a user in Microsoft Entra ID to monitor and manage access to critical resources, ensuring that users do not retain ownership of sensitive groups, applications, or service principals after role changes. This helps prevent security risks, such as unauthorized privilege escalation or orphaned objects that could impact compliance and governance.
Before using the Get-MgUserOwnedObject cmdlet, ensure the following:
Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "User.Read.All"
The Get-MgUserOwnedObject cmdlet can be used in Microsoft Graph PowerShell to fetch Microsoft Entra ID user-owned objects. Here's the syntax:
Get-MgUserOwnedObject
-UserId <String>
[-ExpandProperty <String[]>]
[-Property <String[]>]
[-Filter <String>]
[-Search <String>]
[-Skip <Int32>]
[-Sort <String[]>]
[-Top <Int32>]
[-ConsistencyLevel <String>]
[-ResponseHeadersVariable <String>]
[-Headers <IDictionary>]
[-PageSize <Int32>]
[-All]
[-CountVariable <String>]
[-ProgressAction <ActionPreference>]
[<CommonParameters>]
Example 1: List the objects owned by a particular user
Get-MgUserOwnedObject -UserId <"user_id"> $userId
In this command, replace user_id with the user's ID for whom you would like to list the user-owned objects.
The following table contains some parameters that can be used along with the Get-MgUserOwnedObject command to fetch Microsoft Entra ID user-owned objects efficiently.
| Parameters | Description |
|---|---|
| -All | This parameter retrieves all user-owned objects without default pagination limits. |
| -Filter | This parameter filters user-owned objects based on attributes and values. |
| -UserId | This parameter retrieves user-owned objects based on their unique identifiers, such as user principal name or object ID. |
| -Property | This parameter retrieves specific attributes of user-owned objects. |
| -ConsistencyLevel | This enables advanced query capabilities for improved performance. |
Bid adieu to complicated PowerShell scripts with ADManager Plus. ManageEngine ADManager Plus is a identity governance and administration tool with powerful Microsoft 365 management and reporting capabilities that can help you perform complicated, administrative tasks from a single, user-friendly console.