Skip to main content

​
SYNOPSIS

Retrieves dynamic groups from Microsoft 365, Exchange Online, and Entra ID with attribute analysis.

​
SYNTAX

​
DESCRIPTION

The Get-DynamicGroup function retrieves all dynamic groups from Microsoft 365 environments, including Exchange Online Dynamic Distribution Groups and Entra ID Dynamic Security/M365 Groups. It analyzes membership rules to extract attributes and provides security warnings for attributes in the “Personal-Information” property set that users can modify themselves. By default, only the member count is returned (MembersCount). Use -IncludeMembers to also get the concatenated lists of member names and IDs, or -MemberReport to get one row per (group, member).

​
EXAMPLES

​
EXAMPLE 1

Retrieves all dynamic groups from both Exchange Online and Entra ID (members count only).

​
EXAMPLE 2

Retrieves only Exchange Online Dynamic Distribution Groups.

​
EXAMPLE 3

Retrieves only Entra ID Dynamic Groups.

​
EXAMPLE 4

Retrieves all dynamic groups with MembersName and MembersId populated (pipe-separated).

​
EXAMPLE 5

Returns one row per (group, member). Each row contains the group context and a single member.

​
EXAMPLE 6

Exports both the per-group sheet (“DynamicGroups”) and the per-member sheet (“Members”) in the same Excel workbook.

​
EXAMPLE 7

Returns only the dynamic groups using the deprecated MemberOf rule operator, whose memberships stop updating after November 3, 2026.

​
EXAMPLE 8

Exports the groups using the deprecated MemberOf rule operator to an Excel file.

​
PARAMETERS

​
-DeprecatedMemberOfRuleOnly

When specified, returns only the groups whose membership rule uses the deprecated MemberOf rule operator (e.g. user.memberof -any (group.objectId -in […])). Microsoft ends this preview operator: after November 3, 2026, affected memberships stop updating and stay in their last known state. This operator only exists in Entra ID membership rules, so this switch implies Entra ID only (Exchange Online is skipped, no need to add -EntraIDOnly). Without this switch, the DeprecatedMemberOfRule property still flags affected groups.

​
-EntraIDOnly

When specified, retrieves only Entra ID Dynamic Groups (Security and M365 groups). Requires an active Microsoft Graph connection (use Connect-MgGraph).

​
-ExchangeOnlineOnly

When specified, retrieves only Exchange Online Dynamic Distribution Groups. Requires an active Exchange Online session (use Connect-ExchangeOnline).

​
-ExportPath

Optional output directory for the Excel export (defaults to the user profile).

​
-ExportToExcel

When specified, exports the result to an Excel file in the user’s profile directory instead of returning it. When combined with -MemberReport, the member rows are written to a second worksheet named “Members” in the same workbook.

​
-GroupId

When specified, retrieves dynamic groups by their unique GroupId. If not specified, retrieves all dynamic groups (both Exchange Online and Entra ID).

​
-IncludeMembers

When specified, populates the MembersName (pipe-separated display names) and MembersId (pipe-separated object IDs) properties in addition to MembersCount. By default, only MembersCount is populated to avoid slow enumeration on large groups. Ignored when -MemberReport is used.

​
-MemberReport

When specified, the function returns one row per (group, member) pair instead of the per-group aggregated objects. Useful to export a flat list of members with their parent group. Output columns: GroupId, GroupName, GroupType, MembershipRule, MemberId, MemberDisplayName, MemberPrincipal, MemberType.

​
CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

​
INPUTS

​
OUTPUTS

​
System.Collections.Generic.List[Object]

​
NOTES

OUTPUT PROPERTIES (default / -IncludeMembers mode) Returns a collection of custom objects with the following properties:
  • GroupId: Unique identifier of the group
  • Name: Display name of the group
  • Type: Type of dynamic group (Exchange Dynamic Distribution Group, M365 Dynamic Group, Entra ID Dynamic Security Group)
  • MembershipRule: The membership rule or LDAP filter used for dynamic membership
  • MembershipRuleProcessingState: Processing state of the membership rule (Entra ID only)
  • UserAttributes: Pipe-separated list of user attributes referenced in the membership rule
  • GroupAttributes: Pipe-separated list of group attributes referenced in the membership rule (Entra ID only)
  • DeviceAttributes: Pipe-separated list of device attributes referenced in the membership rule (Entra ID only)
  • MemberOf: Pipe-separated list of parent groups
  • MembersCount: Number of current members of the group
  • MembersName: Pipe-separated list of member display names (only with -IncludeMembers)
  • MembersId: Pipe-separated list of member IDs (only with -IncludeMembers)
  • DisplayName, Description, Mail, MailEnabled, MailNickname, SecurityEnabled, GroupTypes, CreatedDateTime, RenewedDateTime, OnPremisesSyncEnabled, SecurityIdentifier, Classification, Visibility
  • DeprecatedMemberOfRule: True if the membership rule uses the deprecated MemberOf rule operator (preview ending: memberships stop updating after November 3, 2026)
  • Warning: Security warning if any attribute is in the “Personal-Information” property set, and/or deprecation warning if the group uses the MemberOf rule operator
OUTPUT PROPERTIES (-MemberReport mode)
  • GroupId, GroupName, GroupType, MembershipRule
  • MemberId, MemberDisplayName, MemberPrincipal, MemberType
Security Considerations: This function identifies attributes in the “Personal-Information” property set that users can modify themselves, potentially allowing unauthorized group membership. Review warnings carefully. More information on: https://itpro-tips.com/property-set-personal-information-and-active-directory-security-and-governance/