Managing teams in M365 with Microsoft Graph PowerShell

The group administration in Microsoft 365 is a key job for directors – particularly in terms of controlling entry rights, assigning licenses, or managing customers and units. The alternative of the earlier PowerShell modules AzureAD, AzureADPreview, and MSOnline with Microsoft Graph PowerShell marks a paradigm shift. Microsoft Graph PowerShell is predicated on the Graph API and, by way of a unified command mannequin, permits entry to almost all related Microsoft 365 providers – from Entra ID and Trade to Intune and Groups. Teams can be managed this manner. The next article explains how this works and what options can be found. 

Organising Microsoft Graph PowerShell

Microsoft Graph PowerShell is put in instantly in PowerShell or in Home windows Terminal by way of the PowerShell Gallery:

This command installs your entire Microsoft Graph SDK module for the present consumer. Utilizing -Pressure ensures that any prompts are suppressed.

After profitable set up, authentication takes place:

This command opens a login window and authenticates the session with the desired permissions. Group.ReadWrite.All lets you create, edit, and delete teams. Consumer.Learn.All lets you learn consumer knowledge. The permissions solely apply to the present PowerShell session.

Show session permissions:

The command reveals which permissions are at the moment efficient. Directors can view and handle the consented permissions by way of the Entra Admin Heart (previously Azure AD Portal) below “Enterprise Functions” → “Microsoft Graph Command Line Instruments”.

Extension of permissions at runtime:

The command extends an present reference to further permissions. That is needed if write permissions develop into needed at a later date, for instance for consumer adjustments.

Creating teams in Microsoft Graph PowerShell

This instance creates a Microsoft 365 group with mail performance and security measures. The parameter groupTypes = “Unified” makes it appropriate with Groups, Outlook, and Planner.

Teams can be created, edited, and managed instantly by way of a graphical interface in IDM-Portal 5.1, together with their members. That is particularly useful for directors who don’t work completely with PowerShell.

Making a dynamic group:

This group is predicated on a dynamic membership rule. Customers with the attribute division = analysis are mechanically added.

Add Members to Teams

In PowerShell, you possibly can add new customers to present teams:

This command provides a consumer to a gaggle utilizing their object ID. You may get the group ID with Get-MgGroup and the consumer ID with Get-MgUser.

Add a number of members from a CSV file:

The command imports a CSV file with consumer IDs and provides all customers listed within the file to the desired group. The Get-MgGroup cmdlet is used to retrieve details about teams in Microsoft Entra ID. It may be used to checklist all teams or to filter particular ones based mostly on their properties. A useful characteristic is the power to make use of the -Filter parameter to pick out solely teams with sure attributes.

Get-MgUser, alternatively, is used to retrieve consumer data from Entra ID, such because the show identify, UPN (Consumer Principal Identify), or the consumer’s ID. Each instructions are needed to find out object IDs which are required for superior operations like group memberships or license assignments.

Instance: Show all teams within the tenant

This command retrieves all teams within the related shopper. With out the -All parameter, solely the primary web page of outcomes could be returned.

Instance: Show solely teams with the identify “Advertising”

Right here, an OData filter is used to carry out a focused question that solely returns teams with a precise match for the show identify.

Instance: Discovering a particular consumer based mostly on their UPN

This retrieves the entire consumer knowledge for the desired consumer.

Instance: Show all customers with the primary identify “Max”

This command shows all customers whose first identify begins with “Max.” Using startsWith is good for dynamic searches.

Eradicating members from teams utilizing PowerShell

PowerShell can be used to take away teams from present teams:

In fact, additionally it is potential to take away a number of customers from teams without delay:

The command makes use of an inventory of group IDs from a CSV file to take away a consumer from a number of teams without delay.

With IDM-Portal 5.1, members can be added or eliminated by way of drag & drop. Adjustments are saved instantly in Entra ID. This gives an intuitive choice for helpdesk or departmental directors without having to work with PowerShell.

Managing Group House owners in PowerShell

The proprietor has particular permissions for a gaggle. PowerShell additionally lets you handle the group proprietor:

To customise the properties of a gaggle, you need to use the next command, for instance:

The command updates sure fields of a gaggle, similar to description or show identify.

Licensing teams with Microsoft Graph PowerShell

Group-based license task in Microsoft 365 permits directors to assign licenses centrally to a gaggle. As soon as a consumer is a member of this group, they mechanically obtain the assigned license. This considerably reduces administrative overhead and ensures constant license distribution, particularly in dynamic environments or role-based ideas. To assign a license, you need to first decide the accessible license merchandise within the tenant. That is accomplished with the next command:

This command returns an inventory of all license SKUs accessible within the tenant. A novel identifier, generally known as the SkuId, is issued for every license. That is needed to be able to assign a license to a gaggle. As soon as the specified SkuId is understood, the license will be assigned to a gaggle as follows:

Der Parameter GroupId steht für die Objekt-ID der Zielgruppe. Unter AddLicenses wird die SkuId angegeben, die hinzugefügt werden soll. Über RemoveLicenses können gleichzeitig nicht mehr benötigte Lizenzen entfernt werden. Im obigen Beispiel bleibt dieser Parameter leer, es wird nur eine Lizenz hinzugefügt.

Praxisbeispiel:

Ein Unternehmen möchte allen Mitarbeitern der Gruppe „Vertrieb“ automatisch eine Microsoft 365 Enterprise Customary Lizenz bereitstellen. Die Gruppe wurde zuvor mit New-MgGroup erstellt. Nach Ermittlung der passenden SkuId kann die Lizenz mit folgendem Befehl der Gruppe zugeordnet werden:

From this level on, all members of this group will mechanically be assigned the license. This makes administration considerably extra environment friendly, particularly when crew buildings change. To examine which licenses are at the moment assigned to a gaggle, use the next command:

This technique permits license assignments to be tracked and, if needed, reversed. Group-based license task will be mixed completely with automated group memberships and thus built-in into totally automated consumer and license administration.

Superior filtering and evaluation of group buildings in Microsoft 365

Microsoft Graph PowerShell gives highly effective question choices for evaluating particular group data within the Microsoft 365 tenant. A typical use case is that you just question all teams and not using a outlined expiration date. This helps you determine potential legacy teams that the automated expiration mechanisms don’t regulate. 

The ConsistencyLevel eventual parameter is critical to be able to use server-side filter and rely features. The question returns all teams and not using a set expiration date, which helps you determine completely lively safety teams or out of date mission teams, for instance.

You can too filter for particular group varieties, similar to Microsoft Groups teams, by checking if their metadata incorporates the entry resourceProvisioningOptions with the worth Workforce.

This question returns solely these teams that have been created as Microsoft Groups workspaces. That is helpful once you wish to create or clear up an outline of all lively groups in a corporation. To find out the group memberships of a particular consumer, you need to use the next cmdlet:

This lets you show all teams of which the consumer is at the moment a member. These can embody safety teams, Microsoft 365 teams, distribution lists, and even dynamic teams.

For directors preferring to work with a graphical consumer interface, the IDM-Portal from model 5.1 onwards gives full integration of Entra ID group administration. It shows not solely all cloud teams, but additionally teams synchronized from Energetic Listing (in read-only mode). Within the consumer view, a consumer’s group memberships are seen and will be edited instantly. Project is conveniently accomplished by way of a drag-and-drop interface.

As well as, the IDM-Portal permits for the structured show of all group memberships at a look and helps the traceability of adjustments by way of logging features. This vastly simplifies the focused evaluation of group buildings, which is a big benefit in advanced hybrid environments with blended cloud and on-premises operations.

Analyze and handle permissions for cmdlets in a focused method

A key ingredient when working with Microsoft Graph PowerShell is knowing the permissions required for particular cmdlets. Microsoft Graph is predicated on a finely granular permission mannequin that depends on so-called scopes. These have to be specified throughout authentication and decide what’s permitted inside a PowerShell session. To seek out out which permissions a particular cmdlet requires, the next command can be utilized:

This command analyzes the Get-MgUser cmdlet and returns an inventory of all permissions which are required or non-obligatory. The output contains each delegated permissions (which apply on behalf of the at the moment logged-in consumer) and application-related permissions (for app-only entry by way of registered purposes). In observe, this helps to determine the required rights earlier than executing a cmdlet and to specify the suitable scope.

Instance: Checking rights for group modifying

Anybody planning to edit teams ought to examine prematurely whether or not the Replace-MgGroup cmdlet requires further rights. The question command is:

The output then reveals that you just require Group.ReadWrite.All, amongst different issues. This data is essential as a result of with out this scope, you could formulate the command appropriately however it is going to nonetheless fail attributable to lack of authorization. 

Assign rights consciously and securely

Figuring out the required scopes can also be essential for safety causes. As an alternative of granting all permissions by default, this technique lets you outline precisely which permissions a session wants. This reduces the assault floor and follows the precept of least privilege. The precise permissions and their scope will be reviewed graphically by way of the Microsoft Entra Admin Heart (previously Azure AD Portal). Underneath “Enterprise Functions”, you possibly can open the app “Microsoft Graph PowerShell“. Within the “Permissions” part, each granted admin consents and consumer consents are displayed. You can too see which customers have consented to particular scopes. By clicking “Complete Customers”, you possibly can view an inventory of affected accounts. Directors even have the choice to revoke consents individually. Combining PowerShell instructions with clear permission administration within the Microsoft Entra Admin Heart gives a stable basis for managed and audit-compliant use of Microsoft Graph PowerShell.

Overview of Group Administration in IDM-Portal

Beginning with IDM-Portal model 5.1, directors have entry to a completely built-in interface for instantly managing Entra ID teams. Along with the usual view and modifying of group members, the portal gives a user-friendly construction deeply built-in with the Microsoft 365 atmosphere. A key spotlight is the power to show each cloud-based and synchronized AD teams in a constant view. The my-IAM RealGroup Service ensures that it applies all adjustments to Entra ID in actual time by way of the underlying connection.

One other sensible profit lies in administrative management: Teams can’t solely be managed centrally, but additionally maintained instantly within the consumer context. Memberships will be considered and adjusted individually per consumer. Alongside the drag-and-drop characteristic within the members tab, the up to date interface improves general readability. The introduction of hint logging additional simplifies troubleshooting by mechanically documenting technical particulars of actions. For advanced environments with hybrid infrastructure, IDM-Portal gives an efficient bridge that mixes transparency with ease of use.

Artikel erstellt am: 11.08.2025