Get-PurviewRoleReport

SYNOPSIS

Reports on Purview RBAC roles and their effective membership, including groups expanded recursively.

SYNTAX

Get-PurviewRoleReport [[-Identity] <string>] [[-PrincipalID] <string>]
 [[-PrincipalDisplayName] <string>] [-ShowGraph]

DESCRIPTION

Produces a report of the membership of Purview RBAC role groups. By default, the report contains only the roles that have at least one member. When a role member is itself a group (distribution group, mail-enabled security group, dynamic distribution group, or a nested role group), its members are resolved recursively and included in the report with DirectMember set to $false and MemberViaGroup set to the name of the group that is a direct member of the role. Circular group references are detected and skipped automatically.

EXAMPLES

EXAMPLE 1

Get-PurviewRoleReport

Retrieves the Purview RBAC role report, including recursive group expansion.

EXAMPLE 2

Get-PurviewRoleReport -Identity 'Compliance Administrator'

Returns only the membership of the ‘Compliance Administrator’ role group.

EXAMPLE 3

Get-PurviewRoleReport -PrincipalID 'alice@contoso.com'

Returns every Purview role assignment held by alice@contoso.com (direct or via group membership).

EXAMPLE 4

Get-PurviewRoleReport -PrincipalDisplayName 'Alice Doe'

Returns every Purview role assignment held by the user whose DisplayName is ‘Alice Doe’.

EXAMPLE 5

Get-PurviewRoleReport | Where-Object { $_.DirectMember -eq $false } | Format-Table Role, MemberName, MemberViaGroup

Lists all users/objects resolved through group membership, showing which group is a direct member of the role.

EXAMPLE 6

Get-PurviewRoleReport | Export-Csv -NoTypeInformation "$(Get-Date -Format yyyyMMdd)_purviewRoles.csv" -Encoding UTF8

Exports the full report (including group-expanded members) to a CSV file.

PARAMETERS

-Identity

Filter the report on a specific role (matches the Role column, exact case-insensitive).

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: 0
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-PrincipalDisplayName

Filter the report on a specific MemberDisplayName (exact, case-insensitive).

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: 2
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-PrincipalID

Filter the report on a specific principal. Matches MemberName (alias), MemberPrimarySMTPAddres (UPN/SMTP), or MemberObjectID (ExternalDirectoryObjectId / GUID).

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: 1
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ShowGraph

Reserved for future use. When specified, displays a graphical representation of the role membership.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

[System.Collections.Generic.List[Object]] containing PSCustomObject rows with the following properties:

Role

NOTES

Requires ExchangeOnlineManagement module and an active Connect-IPPSSession session.

https://ps365.clidsys.com/docs/commands/Get-PurviewRoleReport

Getting started

Azure

Entra

Exchange

Intune

M365 Apps

Misc

MS Commerce

Share Point

Unified Logs

Get-PurviewRoleReport

SYNOPSIS

SYNTAX

DESCRIPTION

EXAMPLES

EXAMPLE 1

EXAMPLE 2

EXAMPLE 3

EXAMPLE 4

EXAMPLE 5

EXAMPLE 6

PARAMETERS

-Identity

-PrincipalDisplayName

-PrincipalID

-ShowGraph

CommonParameters

INPUTS

OUTPUTS

[System.Collections.Generic.List[Object]] containing PSCustomObject rows with the following properties:

NOTES

​SYNOPSIS

​SYNTAX

​DESCRIPTION

​EXAMPLES

​EXAMPLE 1

​EXAMPLE 2

​EXAMPLE 3

​EXAMPLE 4

​EXAMPLE 5

​EXAMPLE 6

​PARAMETERS

​-Identity

​-PrincipalDisplayName

​-PrincipalID

​-ShowGraph

​CommonParameters

​INPUTS

​OUTPUTS

​[System.Collections.Generic.List[Object]] containing PSCustomObject rows with the following properties:

​NOTES

​RELATED LINKS

SYNOPSIS

SYNTAX

DESCRIPTION

EXAMPLES

EXAMPLE 1

EXAMPLE 2

EXAMPLE 3

EXAMPLE 4

EXAMPLE 5

EXAMPLE 6

PARAMETERS

-Identity

-PrincipalDisplayName

-PrincipalID

-ShowGraph

CommonParameters

INPUTS

OUTPUTS

[System.Collections.Generic.List[Object]] containing PSCustomObject rows with the following properties:

NOTES

RELATED LINKS