👥 Recipe · User & Group Management
Count Total Users in a Microsoft 365 Tenant
Quickly retrieve an accurate total user count for licensing, audits, and capacity planning
Complexity
Beginner
Impact
user-management + reporting + licensing + audit
Context
Why This Matters
Knowing the total number of user accounts in your Microsoft 365 tenant is a foundational data point for license reconciliation, security audits, identity governance reviews, and capacity planning. While the number appears in several admin surfaces, getting a programmatic, repeatable count is essential for automation, reporting dashboards, and scheduled health checks.
This recipe covers three ways to get the count: the Microsoft 365 Admin Center (quickest for a one-off check), the Microsoft Graph API (best for automation), and PowerShell via the Microsoft Graph SDK (best for scripts and scheduled jobs).
When to run this
- Before a licensing renewal or true-up
- As part of a monthly tenant health report
- When reconciling HR headcount against directory accounts
- Before bulk operations that depend on knowing directory size
Expected Outcomes
After completing this recipe you will have:
- An accurate total count of user objects in the tenant (including members and guests unless filtered)
- A reusable Graph API call or PowerShell script you can embed in dashboards or scheduled reports
- Understanding of the
ConsistencyLevel: eventualheader requirement for advanced Graph queries - Optional breakdowns by user type (Member vs. Guest) and account status (enabled vs. disabled)
Risks & Considerations
Things to be aware of
- Member vs. guest users: A raw count of
/usersincludes both member accounts and B2B guest accounts. If you only want employees, filter onuserType eq 'Member'. - Disabled accounts: The default count includes disabled (blocked sign-in) accounts. Filter on
accountEnabled eq trueif you want active users only. - Licensed vs. unlicensed: The user count is NOT the same as your licensed seat count. For license usage, query
/subscribedSkusinstead. - ConsistencyLevel header: Graph's
$countendpoint and$count=truequery option require theConsistencyLevel: eventualHTTP header. Passing it as a query parameter will fail. - Permissions:
User.Read.Allis sufficient. Do not requestDirectory.Read.Allunless you need more than user data. - Deleted users: Soft-deleted users (in the recycle bin for 30 days) are not included in
/users. Query/directory/deletedItems/microsoft.graph.userif you need those.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| User.Read.All | Required to enumerate and count user objects in the tenant directory |
| Directory.Read.All | Alternative permission if you also need to read related directory objects (groups, roles). Not required for a simple user count. |
The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex Pro
Count users via the Microsoft 365 Admin Center
- Sign in to the Microsoft 365 Admin Center as a Global Reader or higher.
- In the left navigation, expand .
- At the top of the Active users list, the total count is displayed (e.g., "1,247 users"). This reflects enabled, non-deleted users.
- To include blocked (disabled) accounts, use the Filter dropdown and select All users.
- For guest user counts, navigate to .
- For a breakdown with exportable data, go to and select the Active users report.
Entra admin center (alternative)
- Sign in to the Microsoft Entra admin center.
- Navigate to .
- The total count is shown at the top of the list. Use the filter bar to scope by user type, creation date, or sign-in activity.
- Click Download users to export a CSV for offline analysis.
Count users with Microsoft Graph
Graph exposes a dedicated $count endpoint that returns an integer. It requires the ConsistencyLevel: eventual HTTP header.
Simple total count
GET https://graph.microsoft.com/v1.0/users/$count
ConsistencyLevel: eventualResponse: a plain integer in the response body, e.g. 1247.
Count only member users (exclude guests)
GET https://graph.microsoft.com/v1.0/users/$count?$filter=userType eq 'Member'
ConsistencyLevel: eventualCount only enabled users
GET https://graph.microsoft.com/v1.0/users/$count?$filter=accountEnabled eq true
ConsistencyLevel: eventualCount with inline page (get count + sample)
GET https://graph.microsoft.com/v1.0/users?$count=true&$top=1&$select=id,displayName,userType
ConsistencyLevel: eventualResponse includes an @odata.count property with the total, plus the first user as a sample:
{
"@odata.count": 1247,
"value": [
{ "id": "...", "displayName": "Ada Lovelace", "userType": "Member" }
]
}Common pitfall
Passing ConsistencyLevel as a query string (?ConsistencyLevel=eventual) will fail with a 400 error. It MUST be an HTTP header.
Count users with the Microsoft Graph PowerShell SDK
The Microsoft.Graph.Users module wraps the Graph endpoints and handles the ConsistencyLevel header for you when you pass -CountVariable.
Install the module (first time only)
Install-Module Microsoft.Graph.Users -Scope CurrentUserConnect and get the count
Connect-MgGraph -Scopes "User.Read.All"
# Total count of all users
Get-MgUser -CountVariable totalUsers -ConsistencyLevel eventual -Top 1 | Out-Null
Write-Host "Total users: $totalUsers"Breakdown by user type and status
# Member users only
Get-MgUser -Filter "userType eq 'Member'" -CountVariable memberCount -ConsistencyLevel eventual -Top 1 | Out-Null
# Guest users only
Get-MgUser -Filter "userType eq 'Guest'" -CountVariable guestCount -ConsistencyLevel eventual -Top 1 | Out-Null
# Enabled users
Get-MgUser -Filter "accountEnabled eq true" -CountVariable enabledCount -ConsistencyLevel eventual -Top 1 | Out-NullThe full downloadable script below produces a formatted summary report.
Next steps