Get-MgRoleReport

SYNOPSIS

Reports on Microsoft Entra ID (Azure AD) roles

SYNTAX

Get-MgRoleReport [[-Identity] <string>] [[-PrincipalID] <string>]
 [[-PrincipalDisplayName] <string>] [[-Scope] <string>] [[-TierLevel] <string>]
 [-IncludeEmptyRoles] [-ExcludePIMEligibleAssignments] [-ForceNewToken]
 [-MaesterMode] [-ExportToExcel]

DESCRIPTION

Reports all the Microsoft Entra ID (Azure AD) roles with their members, including PIM eligible assignments and last sign-in activity.

EXAMPLES

EXAMPLE 1

Get-MgRoleReport

Get all the roles with members, including PIM eligible assignments but without empty roles

EXAMPLE 2

Get-MgRoleReport -Identity 'Global Administrator'

Returns only the assignments of the Global Administrator role (filter accepts both role name and roleDefinitionId).

EXAMPLE 3

Get-MgRoleReport -PrincipalID 'alice@contoso.com'

Returns only the role assignments of alice@contoso.com (direct or via group membership).

EXAMPLE 4

Get-MgRoleReport -PrincipalID '11111111-2222-3333-4444-555555555555'

Returns only the role assignments for the principal matching this ObjectId or AppId.

EXAMPLE 5

Get-MgRoleReport -PrincipalDisplayName 'Alice Doe'

Returns only the role assignments for the principal whose DisplayName is ‘Alice Doe’.

EXAMPLE 6

Get-MgRoleReport -Scope '/'

Returns only the role assignments at tenant scope.

EXAMPLE 7

Get-MgRoleReport -TierLevel 0

Returns only the assignments of Tier 0 (control plane) roles. Each row carries a RoleTier property.

EXAMPLE 8

Get-MgRoleReport -IncludeEmptyRoles

Get all the roles, including the ones without members

EXAMPLE 9

Get-MgRoleReport -ExcludePIMEligibleAssignments

Get all the roles with members (without empty roles), but without PIM eligible assignments

EXAMPLE 10

Get-MgRoleReport | Export-CSV -NoTypeInformation "$(Get-Date -Format yyyyMMdd)_adminRoles.csv" -Encoding UTF8

PARAMETERS

-ExcludePIMEligibleAssignments

Switch parameter to exclude PIM eligible assignments from the report. Default is $false (includes them)

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ExportToExcel

Switch parameter to export the report to an Excel file in the user’s profile directory

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ForceNewToken

Switch parameter to force getting a new token from Microsoft Graph

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-Identity

Filter the report on a specific role. Accepts the role display name (e.g. ‘Global Administrator’) or the role definition Id (GUID).

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: 0
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-IncludeEmptyRoles

Switch parameter to include empty roles in the report

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-MaesterMode

Switch parameter to use with the Maester framework (internal process not presented here)

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-PrincipalDisplayName

Filter the report on a specific principal display name (exact match, case-insensitive).

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: 2
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-PrincipalID

Filter the report on a specific principal. Accepts the UPN (user), AppId (service principal) or ObjectId.

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: 1
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-Scope

Filter the report on the assignment scope (AssignedRoleScope / directoryScopeId). Examples: ’/’ (tenant-wide), ‘/administrativeUnits/<id>’ (AU-scoped), or any resource scope.

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: 3
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-TierLevel

Filter the report on a privileged role tier: ‘0’ (control plane), ‘1’ (service/workload admins) or ‘2’ (lower-privilege / read-mostly). Tiering is based on Sean Metcalf’s (PyroTek3) classification. Regardless of this filter, every row is always annotated with a RoleTier property (Tier0/Tier1/Tier2/Untiered).

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: 4
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

The report is output to an array contained all the audit logs found.

To export in a csv Not documented.

NOTES

https://itpro-tips.com/get-the-office-365-admin-roles-and-track-the-changes/ Written by Bastien Perez (Clidsys.com - ITPro-Tips.com) For more Office 365/Microsoft 365 tips and news, check out ITPro-Tips.com.

https://ps365.clidsys.com/docs/commands/Get-MgRoleReport

​Get-MgRoleReport

​SYNOPSIS

​SYNTAX

​DESCRIPTION

​EXAMPLES

​EXAMPLE 1

​EXAMPLE 2

​EXAMPLE 3

​EXAMPLE 4

​EXAMPLE 5

​EXAMPLE 6

​EXAMPLE 7

​EXAMPLE 8

​EXAMPLE 9

​EXAMPLE 10

​PARAMETERS

​-ExcludePIMEligibleAssignments

​-ExportToExcel

​-ForceNewToken

​-Identity

​-IncludeEmptyRoles

​-MaesterMode

​-PrincipalDisplayName

​-PrincipalID

​-Scope

​-TierLevel

​CommonParameters

​INPUTS

​OUTPUTS

​The report is output to an array contained all the audit logs found.

​NOTES

​RELATED LINKS