List the groups a Microsoft Entra ID user is a member of (Get-MgUserMemberOf)

To list the groups a user belongs to in Microsoft Entra ID, connect to Microsoft Graph and run Get-MgUserMemberOfAsGroup -UserId UPN -All. It returns group objects with DisplayName, Mail and the other group properties. Use the transitive variant to include nested group memberships:

Connect-MgGraph -Scopes 'User.Read.All'
Get-MgUserMemberOfAsGroup -UserId adele@contoso.com -All |
  Sort-Object DisplayName | Select-Object DisplayName, Id, SecurityEnabled, MailEnabled
Get-MgUserTransitiveMemberOfAsGroup -UserId adele@contoso.com -All | Select-Object DisplayName

Replace the UPN with yours. -All follows paging, so users in many groups are listed completely.

Which cmdlet returns what

The plain Get-MgUserMemberOf returns groups, directory roles and administrative units mixed together as generic directory objects. The block reads the output types and Graph URLs of the cmdlets from Microsoft.Graph.Users 2.41.2, offline:

Import-Module Microsoft.Graph.Users
foreach ($c in 'Get-MgUserMemberOf', 'Get-MgUserMemberOfAsGroup', 'Get-MgUserTransitiveMemberOf', 'Get-MgUserTransitiveMemberOfAsGroup') {
  $uri  = (Find-MgGraphCommand -Command $c -ApiVersion v1.0 | Where-Object URI -notmatch 'directoryObject-id').URI
  $type = ((Get-Command $c).OutputType.Name -replace '^.*\.IMicrosoftGraph', '')
  '{0,-38} {1,-16} GET {2}' -f $c, $type, $uri
}
'DirectoryObject properties: ' + (([Microsoft.Graph.PowerShell.Models.MicrosoftGraphDirectoryObject]::new() |
  Get-Member -MemberType Property).Name -join ', ')

Get-MgUserMemberOf                     DirectoryObject  GET /users/{user-id}/memberOf
Get-MgUserMemberOfAsGroup              Group            GET /users/{user-id}/memberOf/group
Get-MgUserTransitiveMemberOf           DirectoryObject  GET /users/{user-id}/transitiveMemberOf
Get-MgUserTransitiveMemberOfAsGroup    Group            GET /users/{user-id}/transitiveMemberOf/group
DirectoryObject properties: AdditionalProperties, DeletedDateTime, Id

A DirectoryObject has no DisplayName property, which is why Get-MgUserMemberOf | Select-Object DisplayName prints empty lines. Either read the name from the dictionary or use the cast cmdlet:

Get-MgUserMemberOf -UserId adele@contoso.com -All |
  Select-Object Id, @{n='Type'; e={$_.AdditionalProperties['@odata.type']}},
                    @{n='Name'; e={$_.AdditionalProperties['displayName']}}

Permissions

When the app lacks permission to read a returned object type, Graph still returns it, but with only id and @odata.type filled in and the rest null.

Filters and counts

-Filter, -Search and -CountVariable on these cmdlets need -ConsistencyLevel eventual, Graph's advanced query mode:

Get-MgUserMemberOfAsGroup -UserId adele@contoso.com -All -ConsistencyLevel eventual `
  -CountVariable groupCount -Filter "startswith(displayName,'Sales')"
$groupCount

The advanced index can lag slightly behind recent changes. Without the header, the request fails with Request_UnsupportedQuery; see Get-MgUser -ConsistencyLevel eventual.

On-premises equivalent

For Active Directory users the cmdlet is Get-ADPrincipalGroupMembership, and for the reverse question (who is in a group, including nested members) see Get-ADGroupMember -Recursive. Graph cmdlets run in Windows PowerShell 5.1 and PowerShell 7 alike.

FAQ