Export-EntraGroupMemberShip

1.1.0

Authenticates interactively against Microsoft Graph using the OAuth 2.0 authorization code
flow with PKCE (Invoke-RestMethod only - no Microsoft.Graph, MSAL.PS, or AzureAD module
dependency): a browser window opens for sign-in and a local loopback listener on 127.0.0.1
catches the redirect, so the token exchange is bound to the machine that requested it.
Device code sign-in is intentionally not supported by this script - per IT Security
requirement, it is not offered as an option or a fallback under any parameter.
The script then enumerates Microsoft Entra ID groups. The report contains one row per group
with:
- GroupName          : the group's display name.
- GroupSource         : Cloud (native Entra ID) or Windows Server AD (synced via Entra Connect).
- GroupType           : Microsoft 365, Security, Mail-Enabled Security, Distribution, Dynamic, etc.
- Members             : comma-separated list of direct members (users and groups). Members that
                         are themselves groups are suffixed with " (Group)".
- NestedGroupMembers : for every direct member that is a group, that nested group's own members,
                         formatted as "NestedGroupName: member1, member2; NextGroup: member3".

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Script -Name Export-EntraGroupMemberShip

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Chendrayan-Venkatesan

Package Details

Author(s)

Chendrayan Venkatesan

Functions

ConvertTo-Base64Url Get-RandomBytes New-PkceCodePair New-OAuthState Get-AvailableLoopbackPort ConvertFrom-QueryString Send-LoopbackResponse Get-AuthorizationCodeAccessToken Invoke-GraphGet Get-EntraGroupTypeLabel Get-EntraGroupSourceLabel Get-EntraMemberTypeLabel Get-EntraMemberDisplayName Get-EntraNestedGroupMemberSummary

Dependencies

This script has no dependencies.

Release Notes

No module dependency. Signs in with the authorization code + PKCE flow via the
system browser and a local loopback listener, and uses Invoke-RestMethod against Microsoft
Graph directly. Device code sign-in has been removed entirely per IT Security requirement: it
has no binding to the requesting device (a known phishing vector) and is commonly blocked by
Conditional Access "Authentication flows" policies. This script only ever uses the loopback
authorization code + PKCE flow.

FileList

Export-EntraGroupMemberShip.nuspec
Export-EntraGroupMemberShip.ps1

Version History

Version	Downloads	Last updated
1.1.0 (current version)	4	9/12/2026
1.0.0	6	9/11/2026