AzurePowerCommands

Microsoft Graph PowerShell commands for reviewing Microsoft Entra ID groups, directory roles, privileged identities, owners, and MFA registration.

This project is the Microsoft Graph successor to the original AzureAD/MSOnline-based AzurePowerCommands.ps1 script.

The examples in this README assume that the updated script is named MgPowerCommands.ps1.

Features

Recursively enumerate users, groups, and service principals in nested groups.
Recursively resolve members assigned to Microsoft Entra directory roles.
Identify members of selected privileged roles.
Generate role overviews including users, groups, service principals, and owners.
Build a consolidated list of highly privileged identities.
Report MFA registration, capability, registered methods, preferred methods, and legacy per-user MFA state.
Return normal PowerShell objects that can be filtered, exported, and processed further.

Requirements

Windows PowerShell 5.1 or PowerShell 7.
The Microsoft Graph PowerShell SDK.
A Microsoft Entra work or school account.
Administrative consent for the required Microsoft Graph delegated permissions.
A supported Microsoft Entra directory role when an API requires both Graph permissions and directory RBAC permissions.

The legacy AzureAD, AzureADPreview, and MSOnline modules are not required.

Installation

Install the Microsoft Graph PowerShell SDK:

Install-Module Microsoft.Graph -Scope CurrentUser

Download and import MgPowerCommands.ps1:

Import-Module .\MgPowerCommands.ps1 -Force

The script can also be dot-sourced:

. .\MgPowerCommands.ps1

Confirm that the public commands are available:

Get-Command -Name Get-Mg* -CommandType Function | Where-Object Source -Like '*MgPowerCommands*'

Connect to Microsoft Graph

The following delegated scopes cover all functionality in the script:

$Scopes = @(
    'Directory.Read.All'
    'AuditLog.Read.All'
    'UserAuthenticationMethod.Read.All'
    'Policy.Read.All'
)

Connect-MgGraph -Scopes $Scopes

The scopes are used as follows:

Scope	Used for
`Directory.Read.All`	Users, groups, service principals, owners, directory roles, and role members
`AuditLog.Read.All`	MFA registration information from `userRegistrationDetails`
`UserAuthenticationMethod.Read.All`	Detailed authentication method objects with `-Detailed`
`Policy.Read.All`	Legacy per-user MFA state from the Microsoft Graph beta authentication requirements endpoint

Inspect the current Graph session with:

Get-MgContext

Disconnect when finished:

Disconnect-MgGraph

Commands

`Get-MgGroupMemberRecursive`

Recursively enumerates a Microsoft Entra group and nested groups. By default, the command returns unique user objects.

Return users

Get-MgGroup -GroupId '<GROUP-ID>' |
    Get-MgGroupMemberRecursive

Find a group by display name:

Get-MgGroup -All |
    Where-Object DisplayName -eq '<GROUP-NAME>' |
    Get-MgGroupMemberRecursive

Return nested groups

Get-MgGroup -GroupId '<GROUP-ID>' |
    Get-MgGroupMemberRecursive -ReturnGroups

Return service principals

Get-MgGroup -GroupId '<GROUP-ID>' |
    Get-MgGroupMemberRecursive -ReturnServicePrincipals

Returned objects include properties such as:

ObjectType
ObjectId
DisplayName
UserPrincipalName
AppId
AccountEnabled
Mail
SecurityEnabled
IsAssignableToRole

`Get-MgDirectoryRoleMemberRecursive`

Recursively enumerates the direct and nested members of an active Microsoft Entra directory role. By default, the command returns unique user objects.

Return users

Get-MgDirectoryRole -DirectoryRoleId '<ROLE-ID>' |
    Get-MgDirectoryRoleMemberRecursive

Find a role by display name:

Get-MgDirectoryRole -All |
    Where-Object DisplayName -eq 'Global Administrator' |
    Get-MgDirectoryRoleMemberRecursive

Return assigned groups

Get-MgDirectoryRole -DirectoryRoleId '<ROLE-ID>' |
    Get-MgDirectoryRoleMemberRecursive -ReturnGroups

Return service principals

Get-MgDirectoryRole -DirectoryRoleId '<ROLE-ID>' |
    Get-MgDirectoryRoleMemberRecursive -ReturnServicePrincipals

`Get-MgPrivilegedRolesMembers`

Enumerates members of the privileged role set defined in the script.

Return privileged users

Get-MgPrivilegedRolesMembers

Get-MgPrivilegedRolesMembers |
    Format-Table ObjectType, DisplayName, UserPrincipalName, ObjectId -AutoSize

Return privileged role groups

Get-MgPrivilegedRolesMembers -ReturnGroups

Return privileged service principals

Get-MgPrivilegedRolesMembers -ReturnServicePrincipals

Export privileged users

Get-MgPrivilegedRolesMembers |
    Export-Csv .\PrivilegedUsers.csv -NoTypeInformation -Encoding UTF8

`Get-MgPrivilegedRolesOverview`

Generates an overview of the selected privileged Microsoft Entra roles. The output includes counts and names for users, groups, group owners, service principals, and service principal owners.

$MgPrivilegedRolesOverview = Get-MgPrivilegedRolesOverview
$MgPrivilegedRolesOverview | Format-Table -AutoSize

Show all properties without table truncation:

$MgPrivilegedRolesOverview |
    Format-List Role, UserCount, Users, GroupCount, Groups,
        GroupOwners, SPsCount, SPs, SPsOwners

Export the overview:

$MgPrivilegedRolesOverview |
    Export-Csv .\PrivilegedRolesOverview.csv -NoTypeInformation -Encoding UTF8

The returned properties are:

Role
UserCount
Users
GroupCount
Groups
GroupOwners
SPsCount
SPs
SPsOwners

Store the original objects in the variable first. Do not assign the result of Format-Table to the variable when the data will be filtered or exported later.

`Get-MgDirectoryRoleOverview`

Generates the same type of overview for all active Microsoft Entra directory roles returned by Get-MgDirectoryRole.

$MgDirectoryRoleOverview = Get-MgDirectoryRoleOverview
$MgDirectoryRoleOverview | Format-Table -AutoSize

Show all properties:

$MgDirectoryRoleOverview |
    Format-List Role, UserCount, Users, GroupCount, Groups,
        GroupOwners, SPsCount, SPs, SPsOwners

Export the overview:

$MgDirectoryRoleOverview |
    Export-Csv .\DirectoryRoleOverview.csv -NoTypeInformation -Encoding UTF8

Difference between the overview commands

Get-MgPrivilegedRolesOverview

Checks only the selected privileged roles defined in the script.

Get-MgDirectoryRoleOverview

Checks every active directory role returned by Microsoft Graph.

`Get-MgPrivilegedObjects`

Returns a consolidated and deduplicated collection of highly privileged users and service principals, including owners of privileged groups and service principals.

$PrivilegedObjects = Get-MgPrivilegedObjects
$PrivilegedObjects | Format-Table -AutoSize

Filter the returned objects by type:

$PrivilegedUsers = $PrivilegedObjects |
    Where-Object ObjectType -eq 'User'

$PrivilegedServicePrincipals = $PrivilegedObjects |
    Where-Object ObjectType -eq 'ServicePrincipal'

Export all privileged identities:

$PrivilegedObjects |
    Export-Csv .\PrivilegedObjects.csv -NoTypeInformation -Encoding UTF8

`Get-MgUserMFAConfiguration`

Reports MFA registration and authentication method information for users.

The primary MFA registration values come from the Microsoft Graph userRegistrationDetails report:

MFA Configured maps to isMfaRegistered.
MFA Capable maps to isMfaCapable.
MFA Methods contains registered methods that can represent strong authentication.
Registered Methods also includes methods that can be used only for SSPR, such as email.
Per-User MFA is the legacy per-user MFA state and does not represent Conditional Access enforcement.

All users

Get-MgUser -All |
    Get-MgUserMFAConfiguration

One user

Get-MgUser -UserId 'user@contoso.com' |
    Get-MgUserMFAConfiguration

Detailed authentication methods

Get-MgUser -UserId 'user@contoso.com' |
    Get-MgUserMFAConfiguration -Detailed |
    Format-List

Detailed output can include:

Authentication Method Objects
MobilePhoneRegistered
OneWaySMS
TwoWayVoiceMobile
PhoneAppOTP
PhoneAppNotification
Registered Email
Registered Phone
FIDO2
WindowsHelloForBusiness
TemporaryAccessPass

MFA status of privileged users

Get-MgPrivilegedRolesMembers |
    Get-MgUserMFAConfiguration

Get-MgPrivilegedRolesMembers |
    Get-MgUserMFAConfiguration -Detailed |
    Format-List

Export MFA data

Get-MgUser -All |
    Get-MgUserMFAConfiguration |
    Export-Csv .\MFAConfiguration.csv -NoTypeInformation -Encoding UTF8

MFA Configured means that a user has registered for MFA. It does not prove that MFA is required for every sign-in. MFA enforcement can come from Conditional Access, Security Defaults, Identity Protection, or legacy per-user MFA.

Migration from the previous version

Previous command	Microsoft Graph command
`Get-AzureADGroupMemberRecursive`	`Get-MgGroupMemberRecursive`
`Get-AzureADDirectoryRoleMemberRecursive`	`Get-MgDirectoryRoleMemberRecursive`
`Get-AzureADPrivilegedRolesMembers`	`Get-MgPrivilegedRolesMembers`
`Get-AzureADPrivilegedRolesOverview`	`Get-MgPrivilegedRolesOverview`
`Get-AzureADDirectoryRoleOverview`	`Get-MgDirectoryRoleOverview`
`Get-AzureADPrivilegedObjects`	`Get-MgPrivilegedObjects`
`Get-AzureADUserMFAConfiguration`	`Get-MgUserMFAConfiguration`

The input commands also changed:

Previous command	Microsoft Graph equivalent
`Connect-AzureAD`	`Connect-MgGraph`
`Get-AzureADUser`	`Get-MgUser`
`Get-AzureADGroup`	`Get-MgGroup`
`Get-AzureADDirectoryRole`	`Get-MgDirectoryRole`
`Get-MsolUser`	`Get-MgUser` and the Microsoft Graph authentication reporting APIs

Common parameter changes include:

-ObjectId  -> -UserId, -GroupId, -DirectoryRoleId, or -ServicePrincipalId
-All $true -> -All

Important limitations

Active directory roles only

Get-MgDirectoryRole returns directory roles that are activated in the tenant. Get-MgDirectoryRoleOverview therefore does not list inactive role templates.

PIM eligibility

The current commands enumerate active directory role membership. Eligible Microsoft Entra Privileged Identity Management assignments are not included.

Static privileged role list

Get-MgPrivilegedRolesMembers and Get-MgPrivilegedRolesOverview use a role-name list defined in the script. Review this list when Microsoft adds or renames directory roles, or when a tenant treats additional roles as privileged.

Beta endpoints

The script uses Microsoft Graph beta endpoints internally for selected compatibility and reporting operations, including the legacy per-user MFA state. Beta APIs can change and should be retested after Microsoft Graph updates.

Group owner availability

Microsoft Graph might not return owners for some Exchange-created groups, distribution groups, or groups synchronized from an on-premises environment.

Read permissions and directory roles

Microsoft Graph permissions alone might not be sufficient for all directory data. In delegated sessions, the signed-in user can also require an appropriate Microsoft Entra directory role. Insufficient access can result in objects containing only an ID and object type.

Troubleshooting

The script is not digitally signed

Files downloaded from the internet can be marked as blocked by Windows:

Unblock-File .\MgPowerCommands.ps1
Import-Module .\MgPowerCommands.ps1 -Force

If an organizational policy enforces AllSigned, the script must be signed by a trusted code-signing certificate.

Check the effective execution policies:

Get-ExecutionPolicy -List

Results contain only IDs

Reconnect with the required scopes and confirm that admin consent has been granted:

Disconnect-MgGraph
Connect-MgGraph -Scopes @(
    'Directory.Read.All'
    'AuditLog.Read.All'
    'UserAuthenticationMethod.Read.All'
    'Policy.Read.All'
)

Then inspect the session:

Get-MgContext | Format-List

Reload after updating the script

Remove-Module MgPowerCommands -ErrorAction SilentlyContinue
Import-Module .\MgPowerCommands.ps1 -Force

Alternatively, open a new PowerShell session.

Show verbose enumeration messages

Get-MgPrivilegedRolesOverview -Verbose

Name		Name	Last commit message	Last commit date
Latest commit History 30 Commits
AzurePowerCommands.ps1		AzurePowerCommands.ps1
LICENSE		LICENSE
README.md		README.md

Folders and files

Latest commit

History

Repository files navigation

AzurePowerCommands

Features

Requirements

Installation

Connect to Microsoft Graph

Commands

Get-MgGroupMemberRecursive

Return users

Return nested groups

Return service principals

Get-MgDirectoryRoleMemberRecursive

Return users

Return assigned groups

Return service principals

Get-MgPrivilegedRolesMembers

Return privileged users

Return privileged role groups

Return privileged service principals

Export privileged users

Get-MgPrivilegedRolesOverview

Get-MgDirectoryRoleOverview

Difference between the overview commands

Get-MgPrivilegedObjects

Get-MgUserMFAConfiguration

All users

One user

Detailed authentication methods

MFA status of privileged users

Export MFA data

Migration from the previous version

Important limitations

Active directory roles only

PIM eligibility

Static privileged role list

Beta endpoints

Group owner availability

Read permissions and directory roles

Troubleshooting

The script is not digitally signed

Results contain only IDs

Reload after updating the script

Show verbose enumeration messages

Microsoft Graph documentation

Author

License

About

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages

`Get-MgGroupMemberRecursive`

`Get-MgDirectoryRoleMemberRecursive`

`Get-MgPrivilegedRolesMembers`

`Get-MgPrivilegedRolesOverview`

`Get-MgDirectoryRoleOverview`

`Get-MgPrivilegedObjects`

`Get-MgUserMFAConfiguration`