Microsoft Entra ID (formerly Azure Active Directory) version 2 cmdlets for group management

1. Retrieving groups

To retrieve existing groups from your directory, use the Get-MgGroups cmdlet.

To retrieve all groups in the connected directory, use the cmdlet without any parameters.

        PS C:\Windows\system32> Get-MgGroup -All

You can also search for a specific group using the -filter parameter, which takes an ODATA filter clause and returns all groups that match that filter.

        PS C:\Windows\system32> Get-MgGroup -Filter "DisplayName eq 'Intune Administrators'"

1. Steps to retrieve a group in M365 Manager Plus

1. Sign in to M365 Manager Plus as Administrator.
2. Navigate to the Reports  tab > Azure Active Directory > Group Reports > All Groups.
3. You can view all the groups in your organization, the group type, the group ID, and more.
4. Use the search option to filter out the report

2. Creating groups

Use the New-MgGroup cmdlet to create a new group in your connected directory.

        $param = @{
        description="My Demo Group"
        displayName="DemoGroup"
        mailEnabled=$false
        securityEnabled=$true
        mailNickname="Demo"
        }
        New-MgGroup @param

2. Steps to create a group in M365 Manager Plus

1. Sign in to M365 Manager Plus as Administrator.
2. Navigate to the Management tab > Azure Active Directory > Group Management > Single Group Creation > Microsoft365 Group Creation .
3. Select the required Microsoft 365 tenant and the template you prefer.
4. Add other information that is needed, such as the group name, members, and owner.
5. Click onApplyto create a new group.
6. You can also create groups in bulk using the Bulk Group Creation management tasks.

3. Updating groups

Use the Update-MgGroup cmdlet to update an existing group.

            PS C:\Windows\system32> Update-MgGroup -GroupId 958d212c-14b0-43d0-a052-d0c2bb555b8b -Description "Demo Group Updated"

3. Steps to modify groups in bulk in M365 Manager Plus

1. Sign in to M365 Manager Plus as Administrator.
2. Navigate to the Management tab > Azure Active Directory > Group Management > Bulk Group Modification.
3. You can choose to modify the group custom attributes, add or remove owners, and more.
4. There are more than 10 tasks that you can choose from.

4. Deleting groups

Use the Remove-MgGroup cmdlet to delete groups from the connected directory.

            PS C:\Windows\system32> Remove-MgGroup -GroupId 958d212c-14b0-43d0-a052-d0c2bb555b8b

4. Steps to delete groups in bulk in M365 Manager Plus

1. Sign in to M365 Manager Plus as Administrator.
2. Navigate to the Management tab > Azure Active Directory > Group Management > Bulk Group Modification > Delete Groups .
3. Select the groups you want to delete. You can also import a CSV file of the group(s). Click on Find.
4. Click on Apply to delete the selected groups.

5. Managing group membership

Use the Add-MgGroupMember cmdlet to add new members to a group.

            PS C:\Windows\system32> New-MgGroupMember -GroupId f76cbbb8-0581-4e01-a0d4-133d3ce9197f -DirectoryObjectId a88762b7-ce17-40e9-b417-0add1848eb68

Use the Get-MgGroupMember cmdlet to get the existing members of a group.

            PS C:\Windows\system32> Get-MgGroupMember -GroupId 2c52c779-8587-48c5-9d4a-c474f2a66cf4

Use the Remove-MgGroupMember to remove a member that was added to as group.

            PS C:\Windows\system32> Remove-MgGroupMemberByRef -DirectoryObjectId 053a6a7e-4a75-48bc-8324-d70f50ec0d91 -GroupId 2c52c779-8587-48c5-9d4a-c474f2a66cf4

Use the Select-MgGroupIdsUserIsMemberOf cmdlet to verify the group memberships of a user.

            PS C:\Windows\system32> New-MgGroupOwner -GroupId 0e48dc96-3bff-4fe1-8939-4cd680163497 -DirectoryObjectId 92a0dad0-7c9e-472f-b2a3-0fe2c9a02867

5. Steps to update group membership in M365 Manager Plus:

1. Sign in to M365 Manager Plus as Administrator.
2. Navigate to the Management tab > Azure Active Directory > Group Member Management > Add/Remove Group Membership using CSV.
3. Select the Microsoft 365 Tenant and upload a CSV file with the required groups and members.
4. Click on Apply to add or remove the members.
5. You can also choose the Modify Microsoft 365 Group Members task.
6. You can add and remove users to groups in this task.

6. Managing owners of groups

Use the New-MgGroupOwner cmdlet to add owners to a group.

            PS C:\Windows\system32> New-MgGroupOwner -GroupId 0e48dc96-3bff-4fe1-8939-4cd680163497 -DirectoryObjectId 92a0dad0-7c9e-472f-b2a3-0fe2c9a02867

Use the Get-MgGroupOwner cmdlet to retrieve the owners of a group.

            PS C:\Windows\system32> Get-MgGroupOwner -GroupId 0e48dc96-3bff-4fe1-8939-4cd680163497

Use the Remove-MgGroupOwnerByRef cmdlet to remove an owner from a group.

            PS C:\Windows\system32> Remove-MgGroupOwnerByRef -GroupId 0e48dc96-3bff-4fe1-8939-4cd680163497 -DirectoryObjectId 92a0dad0-7c9e-472f-b2a3-0fe2c9a02867

6. Steps to update owners of groups in bulk in M365 Manager Plus:

1. Sign in to M365 Manager Plus as Administrator.
2. Navigate to the Management tab > Azure Active Directory > Bulk Group Modification .
3. You can choose to add or remove owners from Microsoft 365 groups, distribution groups, dynamic distribution groups, security groups, and mail enabled security groups.
4. Select the owner(s) you want to add or remove, choose the add or remove function, the Microsoft 365 tenant and the respective group.
5. Click on Apply to perform the action.

7. Disabling group creation

You can restrict non-administrative users from creating security groups within your directory for security purposes. Microsoft Online Directory Services (MSODS) allows non-admin users to create groups by default

            Install-Module Microsoft.Graph.Beta.Identity.DirectoryManagement
                            Import-Module Microsoft.Graph.Beta.Identity.DirectoryManagement
                            $params = @{
                            TemplateId = "62375ab9-6b52-47ed-826b-58e47e0e304b"
                            Values = @(		
                                @{
                                    Name = "EnableGroupCreation"
                                    Value = "false"
                                }		
                            )
                            }
                            Connect-MgGraph -Scopes "Directory.ReadWrite.All"
                            New-MgBetaDirectorySetting -BodyParameter $params