Azure AD group membership PowerShell

by

In this azure tutorial, we will discuss Azure AD group membership PowerShell. Apart from this, we will also discuss on the below topics

  • Create Azure AD group PowerShell
  • Retrieve the existing groups PowerShell
  • Create Azure AD Groups PowerShell
  • Update Azure AD Groups PowerShell
  • Delete Azure AD Groups PowerShell
  • Azure AD add user to the group PowerShell
  • PowerShell command to get azure ad group members
  • PowerShell command to remove azure ad group members
  • Azure AD dynamic groups PowerShell
  • Group types in Azure AD
  • Azure AD group policy PowerShell
  • Create AD group settings at the directory level using PowerShell
  • Update AD group settings at the directory level using PowerShell
  • Read group settings at the directory level using PowerShell
  • Remove group settings at the directory level using PowerShell
  • Create AD group settings for a specific group using PowerShell
  • Update AD group settings for a specific group using PowerShell
  • Azure AD group owner PowerShell
  • How to adds an owner to an AzureAD group using PowerShell
  • How to get an owner details of an AzureAD group using PowerShell.

Azure AD group membership PowerShell

We can use Get-AzureADGroupMember to retrieve a member from the active directory group using PowerShell.

Syntax:

Get-AzureADGroupMember
   -ObjectId <String>
   [-All <Boolean>]
   [-Top <Int32>]
   [<CommonParameters>]

Parameters

-All

If the value is true, return all group members. If the value is false, return the number of objects

-ObjectId

It specifies the ID of a group in Azure AD to which the user belongs to.

-Top

It shows the maximum number of records to return.

You can use the command like below to get the member details from the group in Azure active directory.

PS C:\windows\system32> Get-AzureADGroupMember

Once you will execute the above command, it will ask to enter the ObjectID (The ID of the AD group to which the user belongs to)

Azure AD group membership PowerShell

Now enter the ObjectId then run and the output will be

ObjectId                             DisplayName UserPrincipalName                 UserType
--------                             ----------- -----------------                 --------
ee09bfcd-36e9-47c2-a98c-cf19412540e6 Bks Sahoo   bks@SPSkyTraining.onmicrosoft.com Member
Azure AD group membership using PowerShell

Or else you can also use the command in the below format.

PS C:\windows\system32> Get-AzureADGroupMember -ObjectId "23359f6d-850e-47e3-96b3-6ccae2ecb7bd"

You can mention the ObjectId with the Get-AzureADGroupMember command inline.

AD group membership using PowerShell in Azure

Output will be

ObjectId                             DisplayName UserPrincipalName                 UserType
--------                             ----------- -----------------                 --------
ee09bfcd-36e9-47c2-a98c-cf19412540e6 Bks Sahoo   bks@SPSkyTraining.onmicrosoft.com Member

Note:

Before running the above commands, You need to connect to Azure using the below command

PS C:\windows\system32> Connect-AzureAD
Connect-AzureAD

Create Azure AD group PowerShell

Let’s see how can we create a group, Retrieve the existing groups, Update Groups, Delete groups in Azure Active Directory using PowerShell.

Connect to the Azure Account PowerShell

You must connect your PowerShell session first. Run the below command and enter your username and password.

PS C:\windows\system32> Connect-AzureAD
Create a group and add members in Azure Active Directory using PowerShell

You can see above the session connected Successfully

Retrieve the existing groups PowerShell

You can use Get-AzureADGroups to get the list of groups present in your AD using the below command.

The syntax is

Get-AzureADGroup [-All <Boolean>] [-Top <Int32>] [-Filter <String>] [<CommonParameters>]

or

Get-AzureADGroup [-SearchString <String>] [-All <Boolean>] [<CommonParameters>]

or

Get-AzureADGroup -ObjectId <String> [-All <Boolean>] [<CommonParameters>]
PS C:\windows\system32> get-azureadgroup
Retrieve the existing groups from AzureAD using PowerShell

For specific group,You can use the -objectID parameter to retrieve 

PS C:\Windows\system32> get-azureadgroup -ObjectId 219b773f-bc3b-4aef-b320-024a2eec0b5b

Output will be

ObjectId                             DisplayName  Description                   
--------                             -----------  -----------                   
219b773f-bc3b-4aef-b320-024a2eec0b5b TSInfo Users This group is for TSInfo Users
Retrieve the specific group from AzureAD using PowerShell

ObjectId 219b773f-bc3b-4aef-b320-024a2eec0b5b is the objectID for a specific group. In my case, it is TSInfo Users group.

Create Azure AD Groups PowerShell

You can create a group in your AD using the New-AzureADGroup command.

The syntax is 

New-AzureADGroup [-InformationAction <ActionPreference>] [-InformationVariable <String>] [-Description <String>] -DisplayName <String> -MailEnabled <Boolean> -MailNickName <String> -SecurityEnabled <Boolean> [<CommonParameters>]

Parameters:

  • -Description: We can use this parameter to set the description of the AD group.
  • -DisplayName: We can set the display name for the group.
  • -InformationVariable: It sets the information variable
  • -MailEnabled: It shows whether mail is enabled or not
  • -MailNickName: It set’s the mail nick name
  • -SecurityEnabled: It shows if the group is security enabled or not.

For example:

PS C:\Windows\system32> New-AzureADGroup -Description "TsInfoGroupNew group is for TsInfo" -DisplayName "TsInfoGroupNew" -MailEnabled $false -SecurityEnabled $true -MailNickName "TsInfoGroupNew"

The output will be

ObjectId                             DisplayName    Description                       
--------                             -----------    -----------                       
23359f6d-850e-47e3-96b3-6ccae2ecb7bd TsInfoGroupNew TsInfoGroupNew group is for TsInfo

You can see below the group created successfully.

Create AD Groups using Powershell

Update Azure AD Groups PowerShell

You can update the info for the group created, Using Set-AzureADGroup command.

The syntax is

Set-AzureADGroup -ObjectId <String> [-InformationAction <ActionPreference>] [-InformationVariable <String>] [-Description <String>] [-DisplayName <String>][-MailEnabled <Boolean>][-MailNickName <String>] [-SecurityEnabled <Boolean>] [<CommonParameters>]

For example, If we want to change the description for above group created.

PS C:\Windows\system32> Set-AzureADGroup -ObjectId 219b773f-bc3b-4aef-b320-024a2eec0b5b -Description "This group is TsInfoGroupNew"

This will change the description from TsInfoGroupNew to This group is TsInfoGroupNew.

Delete Azure AD Groups PowerShell

To delete the specific group you can use the below command.

PS C:\Windows\system32> Remove-AzureADGroup -ObjectId 219b773f-bc3b-4aef-b320-024a2eec0b5b

ObjectId 219b773f-bc3b-4aef-b320-024a2eec0b5b is the objectID for a specific group.

Azure AD add user to the group PowerShell

Now our group TsInfoGroupNew is created, we can add members to the group

We can use Add-AzureADGroupMember command to add the member to the group.

The syntax is

Add-AzureADGroupMember -ObjectId <String> -RefObjectId <String>[-InformationAction <ActionPreference>]
   [-InformationVariable <String>] [<CommonParameters>]

Parameter:

  • -ObjectId: Sets the ID of a group in Azure Active Directory.
  • -RefObjectId: Sets the ID of the Active Directory group member
PS C:\Windows\system32> Add-AzureADGroupMember -ObjectId 23359f6d-850e-47e3-96b3-6ccae2ecb7bd -RefObjectId e09bfcd-36e9-47c2-a98c-cf19412540e6
Add members to the AD group using powershell.

Here, ObjectId parameter is the ObjectID of the group and the RefObjectId is the ObjectID of the user we want to add as a member.

PowerShell command to get azure ad group members

If you want to get the existing members belongs to a group you can use Get-AzureADGroupMember command.

The syntax is

Get-AzureADGroupMember -ObjectId <String> [-All <Boolean>] [-Top <Int32>] [<CommonParameters>]
 PS C:\Windows\system32> Get-AzureADGroupMember -ObjectId 219b773f-bc3b-4aef-b320-024a2eec0b5b

The output will be

ObjectId                             DisplayName UserPrincipalName                 UserType
--------                             ----------- -----------------                 --------
ee09bfcd-36e9-47c2-a98c-cf19412540e6 Bks Sahoo   bks@SPSkyTraining.onmicrosoft.com Member
Get members from specific AD group using PowerShell

PowerShell command to remove azure ad group members

You can remove the member we previously added to the group, we can use the Remove-AzureADGroupMember.

PS C:\Windows\system32> Remove-AzureADGroupMember -ObjectId f21bae22-8ac0-780c-bc37-udae0f3da61i -MemberId ee09bfcd-36e9-47c2-a98c-cf19412540e6

Azure AD dynamic groups PowerShell

You can also create a Dynamic Group in Azure Active Directory using the below command.

PS C:\Windows\system32> New-AzureADMSGroup -DisplayName "TsInfoDynamicGroup" -Description "Dynamic group for TsInfo" -MailEnabled $False -MailNickName "group" -SecurityEnabled $True -GroupTypes "DynamicMembership" -MembershipRule "(user.department -contains ""TS"")" -MembershipRuleProcessingState "On"

Parameters

  • -Description: This sets a description for the group.
  • -DisplayName: This property sets a display name for the group.
  • -GroupTypes: Sets that the group is a dynamic group. specify a value of DynamicMembership if you want to create a dynamic group.
  • -MembershipRuleProcessingState: Sets the rule processing state.

The options are

1- “On”– It will process the group rule.

2- “Paused”– It will stop processing the group rule.

-Visibility

This property sets the visibility of the group’s content and members list. The options are

“Public” , “Private”, and “HiddenMembership”.

The default value is “Public”.

Azure AD group types

There are two types of Azure AD group.

1- Static AD group

You can consider a group as Static whose membership will not change.

You can change a dynamic group to static using PowerShell. Execute the below line of code in your PowerShell ISE or Windows PowerShell.

$mydynamicGroup = "DynamicMembership"

function ToConvertDynamicGroupToStatic
{
    Param([string]$groupId)

    
    [System.Collections.ArrayList]$mygroupTypes = (Get-AzureAdMsGroup -Id $mygroupId).GroupTypes

    if($mygroupTypes -eq $null -or !$mygroupTypes.Contains($mydynamicGroup))
    {
        throw "This group is already a static group. No changes required.";
    }


    $mygroupTypes.Remove($mydynamicGroup)

    Set-AzureAdMsGroup -Id $mygroupId -GroupTypes $mygroupTypes.ToArray() -MembershipRuleProcessingState "Paused"
}

ToConvertDynamicGroupToStatic "23359f6d-850e-47e3-96b3-6ccae2ecb7bd"

“23359f6d-850e-47e3-96b3-6ccae2ecb7bd” is the id of my AzureAD group.

How to convert the dynamic AD group to static AD group

Since my AD group is already a static group so it showed me “This group is already a static group. No changes required.” else it would have converted the dynamic group to a static group.

2- Dynamic AD group

You can consider a group as dynamic whose membership can change based on certain set of criteria.

You can change a static group to dynamic using PowerShell. Execute the below line of code in your PowerShell ISE or Windows PowerShell.

function ToConvertStaticGroupToDynamic
{
    Param([string]$mygroupId, [string]$mydynamicMembershipRule)

   
    [System.Collections.ArrayList]$mygroupTypes = (Get-AzureAdMsGroup -Id $mygroupId).GroupTypes

    if($mygroupTypes -ne $null -and $mygroupTypes.Contains($mydynamicGroupTypeString))
    {
        throw "This group is already a dynamic group. No changes required.";
    }
    
    $mygroupTypes.Add($mydynamicGroupTypeString)

    
    Set-AzureAdMsGroup -Id $mygroupId -GroupTypes $mygroupTypes.ToArray() -MembershipRuleProcessingState "On" -MembershipRule $mydynamicMembershipRule

}

ToConvertStaticGroupToDynamic "23359f6d-850e-47e3-96b3-6ccae2ecb7bd"
azure ad dynamic group based on group membership

Azure AD group policy PowerShell

You can use Azure Active Directory (Azure AD) PowerShell cmdlets to create and update group settings.

This is applicable for the Office 365 groups.

  • You can configure Office 365 Groups settings using a Settings object and a SettingsTemplate object. 
  • You can use “Group. Unified” template to configure Office 365 group settings for your Active Directory.
  • You can also use “Group.Unified.Guest” to configure Office 365 group settings for a single group.

Create AD group settings at the directory level using PowerShell

You can use the below steps to to create and update the Active Directory group settings.

Step-1:

You can execute the below cmdlet using Windows PowerShell or PowerShell ISE to get the list of all settings templates.


PS C:\windows\system32> Get-AzureADDirectorySettingTemplate
Azure AD group policy PowerShell

Step-2:

You can add a usage guideline URL, Use the below cmdlet 

$MyNewTemplateId = (Get-AzureADDirectorySettingTemplate | where { $_.DisplayName -eq "Group.Unified" }).Id
$MyNewTemplate = Get-AzureADDirectorySettingTemplate | where -Property Id -Value $MyNewTemplateId -EQ
create Azure AD group policy PowerShell

Step-3:

Now you need to create a new settings object based on the template we have created.

$MyADSetting = $MyNewTemplate.CreateDirectorySetting()
Azure AD group policy using PowerShell

Step-4:

Then you can update the usage guideline value url

$MyADSetting["UsageGuidelinesUrl"] = "https://enjoysharepoint.com"
How to create Azure AD group policy using PowerShell

Step-5:

Now you can apply the settings using the below cmdlet.

New-AzureADDirectorySetting -DirectorySetting $MyADSetting
Azure AD group policy PowerShell

Update AD group settings at the directory level using PowerShell

You can also update the AD group settings at the directory level using PowerShell

You can follow the below steps

Step-1:

You can get the current settings from the Group.Unified Settings Template

$MyADSetting = Get-AzureADDirectorySetting | ? { $_.DisplayName -eq "Group.Unified"}
update ad group settings azure

Step-2:

You can check the current settings using the below cmdlet in your PowerShell window or PowerShell ISE.

$MyADSetting.Values
Update AD group settings at the directory level using PowerShell

Step-3:

You can update the value of UsageGuideLinesUrl

$MyADSetting["UsageGuidelinesUrl"] = "https://sharepointsky.com"
Update AD group settings at the directory level using PowerShell

Step-4:

Now you can save the changes using the below PowerShell cmdlet.

Set-AzureADDirectorySetting -Id $MyADSetting.Id -DirectorySetting $MyADSetting
Update AD group settings at the directory level in PowerShell

Read group settings at the directory level using PowerShell

We can use the below cmdlet to retrieve the current group settings value using PowerShell.

Get-AzureADDirectorySetting -All $True
Read group settings at the directory level using PowerShell

If you want to read all settings for a specific group then use the below command in your PowerShell window or PowerShell ISE.

Get-AzureADObjectSetting -TargetObjectId ce6n4789-446j-8er6-8ga5-du6b1y53c809 -TargetType Groups
Read group settings using PowerShell

Remove group settings at the directory level using PowerShell

You can execute the below cmdlet to remove the group settings at the directory level using PowerShell

Remove-AzureADDirectorySetting –Id ce6n4789-446j-8er6-8ga5-du6b1y53c809
Remove group settings at the directory level using PowerShell

Create AD group settings for a specific group using PowerShell

You can create AD group settings for a specific group using PowerShell by following the below steps.

Step-1:

You can execute the below cmdlet to get the list of all settings templates. You will get all the lists. Search for the “Groups.Unified.Guest” and get the Id for that. In my case it is 07e632c8-061g-5f27-63b1-87cee671d2e8.

PS C:\windows\system32> Get-AzureADDirectorySettingTemplate
Create AD group settings for a specific group using PowerShell

Step-2:

Get the template object for the specific template using the below PowerShell cmdlet.

$MySingleTemplate = Get-AzureADDirectorySettingTemplate | where -Property Id -Value "07e632c8-061g-5f27-63b1-87cee671d2e8" -EQ
Create AD group settings for a specific group using PowerShell

Step-3:

Create a new copy of settings object from the existing template

$MySettingsCopy = $MySingleTemplate.CreateDirectorySetting()
Create AD group settings for a specific group using PowerShell in Azure

Step-4:

Set the setting to the required value

$MySettingsCopy["AllowToAddGuests"]=$False
how to Create AD group settings for a specific group using PowerShell

Step-5:

Get the ID of the group 

$mygroupID= (Get-AzureADGroup -SearchString "TsInfo group").ObjectId

TsInfo group is my group name

how to Create AD group settings for a specific group using PowerShell

Step-6:

Now you can create the new setting for the specific group

New-AzureADObjectSetting -TargetType Groups -TargetObjectId $mygroupID -DirectorySetting $MySettingsCopy
Create Active Directory group settings for a specific group using PowerShell

Update AD group settings for a specific group using PowerShell

Follow the below steps to update AD group settings for a specific group using PowerShell.

Step-1:

You can get the ID of the specific group using the below cmdlet.

$mygroupID= (Get-AzureADGroup -SearchString "TsInfo group").ObjectId
how to update AD group settings for a specific group using PowerShell

Step-2:

You can retrieve the settings of the specific group using the below cmdlet.

$MySettings = Get-AzureADObjectSetting -TargetObjectId $mygroupID -TargetType Groups
Update AD group settings for a specific group using PowerShell

Step-3:

We can update the property of the group

$MySettings["AllowToAddGuests"] = $True
how to update AD group settings for a specific group using PowerShell

Step-4:

Now get the ID of the specific group using the below cmdlet.

Get-AzureADObjectSetting -TargetObjectId $mygroupID -TargetType Groups
Update AD group settings for a specific group using PowerShell

Step-5:

Now you can save the new value.

Set-AzureADObjectSetting -TargetType Groups -TargetObjectId $mygroupID -Id 07e632c8-061g-5f27-63b1-87cee671d2e8 -DirectorySetting $MySettings
Update AD group settings for a specific group using PowerShell in azure

Azure AD group owner PowerShell

We can add the Owner to the Azure AD group and also can get the owner details for a specific group using PowerShell.

How to adds an owner to an AzureAD group using PowerShell

We can add the Owner to an existing Active Directory group using the below command.

The syntax is

Add-AzureADGroupOwner
   -ObjectId <String>
   -RefObjectId <String>
   [-InformationAction <ActionPreference>]
   [-InformationVariable <String>]
   [<CommonParameters>]

For example:

Add-AzureADGroupOwner -ObjectId "23359f6d-850e-47e3-96b3-6ccae2ecb7bd" -RefObjectId "ee09bfcd-36e9-47c2-a98c-cf19412540e6"
Azure AD group owner PowerShell

Here objectID is 23359f6d-850e-47e3-96b3-6ccae2ecb7bd which is my groupID.

RefObjectId is ee09bfcd-36e9-47c2-a98c-cf19412540e6 which is the member id to whom i want to add as a owner to my group.

How to get an owner details of an AzureAD group using PowerShell.

We have added the owner to the AzureAD group. Let’s retrieve the owner details of that AzureAD group.

We need to use the below cmdlet to get the owner details.

The syntax is

Get-AzureADGroupOwner
   -ObjectId <String>
   [-All <Boolean>]
   [-Top <Int32>]
   [<CommonParameters>]

Example:

Get-AzureADGroupOwner -ObjectId "23359f6d-850e-47e3-96b3-6ccae2ecb7bd"
How to get an owner details of an AzureAD group using PowerShell.

Here objectID is 23359f6d-850e-47e3-96b3-6ccae2ecb7bd which is my groupID.

You may like following Azure tutorials:

Conclusion

In this Azure tutorial, We discussed

  • Create Azure AD group PowerShell
  • Retrieve the existing groups PowerShell
  • Create Azure AD Groups PowerShell
  • Update Azure AD Groups PowerShell
  • Delete Azure AD Groups PowerShell
  • Azure AD add user to the group PowerShell
  • PowerShell command to get azure ad group members
  • PowerShell command to remove azure ad group members
  • Azure AD dynamic groups PowerShell
  • Group types in Azure AD
  • Group policy in Azure AD PowerShell
  • Create AD group settings at the directory level using PowerShell
  • Update AD group settings at the directory level using PowerShell
  • Read group settings at the directory level using PowerShell
  • Remove group settings at the directory level using PowerShell
  • Create AD group settings for a specific group using PowerShell
  • Update AD group settings for a specific group using PowerShell
  • Azure AD group owner PowerShell
  • How to adds an owner to an AzureAD group using PowerShell
  • How to get an owner details of an AzureAD group using PowerShell.