🔐 Recipe · Entra ID & Identity
Identify Administrators with Group Management Permissions in Entra ID
Audit directory role assignments to discover who can create, modify, or manage group memberships in your tenant
Complexity
Intermediate
Impact
security + compliance + access-review + privileged-access
Context
Why This Matters
In Microsoft Entra ID (formerly Azure AD), the ability to manage group memberships is not limited to a single role. Several built-in directory roles carry this privilege — most notably Global Administrator, Privileged Role Administrator, User Administrator, Groups Administrator, and Directory Writers. Owners of individual groups can also manage membership for their own groups.
Regularly auditing who holds these roles is a core part of privileged access hygiene. Group memberships frequently drive access to SharePoint sites, Teams, license assignments, Conditional Access exclusions, and application permissions — so anyone who can modify group membership can effectively escalate access across your tenant.
Run this recipe during quarterly access reviews, after organizational changes, before compliance audits (SOC 2, ISO 27001, HIPAA), or whenever you suspect unnecessary privilege sprawl.
Expected Outcomes
After completing this recipe you will have:
- A full inventory of users assigned to directory roles that grant group management permissions
- Identification of each role holder's assignment type (permanent vs. eligible via PIM)
- A CSV/report suitable for access review sign-off
- Visibility into service principals and groups that also hold these roles
- A baseline to compare against in future audits
Risks & Considerations
Cautions
- Read-only audit. This recipe does not modify role assignments. Removing a Global Administrator without a backup break-glass account can lock you out of your tenant.
- PIM eligibility matters. Standard
/directoryRoles/{id}/membersreturns only active assignments. Users eligible via Privileged Identity Management are invisible unless you query the PIM endpoints. - Group-based and nested assignments. Roles can be assigned to groups; enumerate group members to see the effective admin list.
- Custom roles and admin units. If your org uses custom roles or administrative-unit-scoped assignments, additional queries are required.
- Group owners also manage membership for their groups. Don't forget them in your threat model.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| RoleManagement.Read.Directory | Read directory role definitions and role assignments (including PIM eligibility) |
| Directory.Read.All | Resolve principal IDs to user, group, and service principal details |
| PrivilegedAccess.Read.AzureAD | Optional — read PIM eligible role assignments |
The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex Pro
Audit Group-Management Admins via the Entra Portal
- Sign in to the Microsoft Entra admin center at
https://entra.microsoft.comas a Global Reader or Privileged Role Administrator. - Navigate to:
- Review each of the following roles in turn. For each, click the role name and review both the Assignments tab (active) and Eligible assignments tab (PIM):
- Global Administrator
- Privileged Role Administrator
- User Administrator
- Groups Administrator
- Directory Writers
- Teams Administrator (can manage Microsoft 365 group membership)
- Exchange Administrator (can manage distribution and M365 groups)
- SharePoint Administrator (can manage M365 group membership)
- For each assignment, record: display name, UPN, principal type (User / Group / Service Principal), assignment type (Active / Eligible), and scope (Directory / Administrative Unit).
- If a role is assigned to a group, click the group and enumerate its members — these members inherit the role.
- Export each role's member list: on the role page click Download assignments to save as CSV.
- Cross-check against your approved privileged access list. Flag any unexpected holders for removal or review.
Also review group owners
Group owners can manage their group's membership independently of directory roles. Navigate to
and review ownership on sensitive groups (admin groups, license-bearing groups, CA exclusion groups).Enumerate Role Holders via Microsoft Graph
Step 1 — List role definitions that grant group management
GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleDefinitions
?$filter=displayName in (
'Global Administrator',
'Privileged Role Administrator',
'User Administrator',
'Groups Administrator',
'Directory Writers'
)
&$select=id,displayNameStep 2 — Get active role assignments for each role
GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments
?$filter=roleDefinitionId eq '{roleDefinitionId}'
&$expand=principalSample response:
{
"value": [
{
"id": "lAPpYvVpN0KR...",
"principalId": "8a7b...",
"roleDefinitionId": "62e90394-...",
"directoryScopeId": "/",
"principal": {
"@odata.type": "#microsoft.graph.user",
"displayName": "Alex Admin",
"userPrincipalName": "alex@contoso.com"
}
}
]
}Step 3 — Get PIM eligible assignments (optional but recommended)
GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleEligibilitySchedules
?$filter=roleDefinitionId eq '{roleDefinitionId}'
&$expand=principalStep 4 — Expand group assignments
If any principal is of type #microsoft.graph.group, enumerate its transitive members:
GET https://graph.microsoft.com/v1.0/groups/{groupId}/transitiveMembers
?$select=id,displayName,userPrincipalNameRequired headers
Authorization: Bearer {access_token}
ConsistencyLevel: eventual # required for $filter on roleDefinitionsAutomate with Microsoft Graph PowerShell
The script below connects to Microsoft Graph, enumerates every directory role that grants group management permissions, resolves active and eligible assignments, expands group-based assignments, and exports the result to CSV.
Prerequisites
- PowerShell 7+ (Windows PowerShell 5.1 also works)
Microsoft.Graphmodule:Install-Module Microsoft.Graph -Scope CurrentUser- An account with at minimum the Global Reader role
How it works
- Connects with the required read-only scopes.
- Resolves role definition IDs for the target roles by display name.
- Calls
Get-MgRoleManagementDirectoryRoleAssignmentfor active members andGet-MgRoleManagementDirectoryRoleEligibilitySchedulefor PIM eligibles. - Flattens group assignments into their member users.
- Emits a unified CSV report with columns:
RoleName, PrincipalType, DisplayName, UserPrincipalName, AssignmentType, SourceGroup.
Run it
.\Get-GroupManagementAdmins.ps1 -OutputPath .\group-admins.csvOpen the CSV in Excel, sort by RoleName, and review each holder. Pay special attention to service principals and to eligible (PIM) assignments that may be overlooked in the GUI.
Next steps