导出所有 Azure AD 组，包括嵌套组、它们的成员和所有者 (PowerShell)

Question

What would be a PowerShell script to export all Azure AD groups, their members and owners into one CSV file?

I also need an expanded nested groups.

Answer 1

Here is something I came up with, should work as long as you have the azuread powershell module.

function get-recursivegroupmembers {
    param($grouplistname, $currgroup, $groupmemtype)
    $members = if ($groupmemtype -eq "owner") {get-azureadgroupowner -ObjectId $currgroup.ObjectId -All $true} else {get-azureadgroupmember -ObjectId $currgroup.ObjectId -All $true}
    $grouptype = "Distribution Group"
    if ($currgroup.SecurityEnabled -eq $true)
    {
        $grouptype = "Security Group"
    }
    foreach ($member in $members)
    {

        if($member.ObjectType -eq "Group" )
            { get-recursivegroupmembers "$grouplistname->$($member.DisplayName)" $member $groupmemtype}
        else
            { 
                add-content -Path $filename -Value "$grouplistname,$grouptype,$groupmemtype,$($member.ObjectId),$($member.ObjectType) $($member.UserType),$($member.UserPrincipalName)" }
    }
}

connect-AzureAD
$filename = ".\groupusers-$(get-date -f 'ddMMyyyy-HHmmss').csv"
$groups=Get-AzureADGroup -All $true
add-content -Path $filename -Value "Group(s),Group Type,Member Type,User ObjectId,AAD Object Type,UPN" 

ForEach ($group in $groups)
{
    get-recursivegroupmembers $group.DisplayName $group "owner"
    get-recursivegroupmembers $group.DisplayName $group "member"
} 

This will give you a file in the current folder where the script is. called groupusers, first field will contain group and if its a nested group member would show like group->nestedgroup, owner or member, etc.

Answer 2

Sorry couldn't comment as I don't have enough rep, I created an account to thank you Peter.

This worked a treat. I had tried multiple other articles but this one works. All I did was to target groups with a specific naming scheme was change this line and remove $true as that said 'a positional parameter cannot be found that accepts the argument True'

$groups = Get-AzureADGroup -SearchString "File Share"

That then searches for any group starting with 'File Share'