👥 Recipe · User & Group Management
Filter Users by Job Title or Department via Microsoft Graph
Query Entra ID for users matching a role or organizational unit using Graph filters
Complexity
Beginner
Impact
read-only + reporting + user-management + directory-query
Context
Why This Matters
IT admins frequently need to pull scoped lists of users — for example, all Engineers, everyone in Finance, or staff with a specific title pattern. Manually scrolling the Entra admin center is slow and error-prone, especially in tenants with thousands of users. Microsoft Graph's $filter query parameter on the /users endpoint lets you target users precisely by jobTitle, department, or other directory attributes.
Common scenarios include:
- Building a distribution list or security group for a role-based audience
- License reviews scoped to a department
- Identifying users for targeted Conditional Access or MFA rollouts
- Generating reports for HR, compliance, or management
Expected Outcomes
After completing this recipe you will have:
- A filtered list of users matching a given job title, title prefix, or department
- Selected attributes for each user (id, displayName, UPN, jobTitle, department)
- A reusable query pattern you can adapt to any directory attribute exposed by Graph
- Exported results (optional) as CSV for downstream workflows
Risks & Considerations
Things to be aware of
- Data quality: Filters are only as good as the attribute data. If HR hasn't populated
jobTitleordepartmentconsistently, results will be incomplete. - Case sensitivity:
eqfilters are case-sensitive. Usestartswithor normalize input to catch variations like "engineer" vs "Engineer". - Advanced query flags: Some filter operators (like
endsWith,$count,$searchon directory objects) require theConsistencyLevel: eventualheader and$count=true. - Paging: Large result sets return an
@odata.nextLink. Scripts must follow paging or they will miss users. - Privacy: Exported user lists contain PII. Store and share them according to your data handling policy.
- Guest users: External (B2B) guests may also match. Add
userType eq 'Member'to the filter if you want employees only.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| User.Read.All | Required to read directory user profiles including jobTitle and department |
| Directory.Read.All | Alternative, broader read access to directory objects if User.Read.All is not granted |
The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex Pro
Filter users in the Microsoft Entra admin center
The Entra portal supports ad-hoc filtering of the users blade — useful for quick lookups without writing a query.
- Sign in to the Microsoft Entra admin center as a user with at least Directory Readers.
- Navigate to .
- Click Add filter above the user list.
- Choose Job title (or Department) from the property dropdown.
- Enter the value to match — for example
EngineerorEngineering— and click Apply. - The grid now shows only matching users. Use Columns to add Job title and Department so they are visible.
- (Optional) Click Download users to export the filtered set as CSV.
Notes
- The portal filter does substring/contains matching by default, which is more forgiving than the Graph
eqoperator. - For complex multi-attribute queries (e.g. Engineering department AND enabled accounts), use Graph or PowerShell instead.
Query Microsoft Graph directly
Use the /users endpoint with $filter and $select to target users and return only the fields you need.
Basic: exact job title match
GET https://graph.microsoft.com/v1.0/users?$filter=jobTitle eq 'Engineer'&$select=id,displayName,userPrincipalName,jobTitle,departmentCombined: title prefix OR department
GET https://graph.microsoft.com/v1.0/users?$filter=startswith(jobTitle,'Engineer') or department eq 'Engineering'&$select=id,displayName,userPrincipalName,jobTitle,departmentSample response
{
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users",
"value": [
{
"id": "8f2d3187-5fad-4d73-a9f5-3c356e68a038",
"displayName": "Isaiah Langer",
"userPrincipalName": "IsaiahL@contoso.onmicrosoft.com",
"jobTitle": "Software Engineer",
"department": "Engineering"
}
]
}Advanced filters (require eventual consistency)
For endsWith, $count, or $search on directory objects, add the ConsistencyLevel header:
GET https://graph.microsoft.com/v1.0/users?$filter=endsWith(jobTitle,'Engineer')&$count=true&$select=id,displayName,jobTitle
ConsistencyLevel: eventualPaging
If the response contains @odata.nextLink, issue a GET to that URL to retrieve the next page. Continue until no nextLink is present.
Useful variants
$filter=department eq 'Engineering' and accountEnabled eq true— only enabled accounts$filter=department eq 'Engineering' and userType eq 'Member'— exclude guests$orderby=displayName— sort results (may requireConsistencyLevel: eventualwhen combined with$filter)
PowerShell with the Microsoft Graph SDK
The Microsoft.Graph module wraps the same /users endpoint and handles paging automatically via -All.
1. Install & connect
Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "User.Read.All"2. Filter by job title or department
# Exact job title match
Get-MgUser -Filter "jobTitle eq 'Engineer'" -Property Id,DisplayName,UserPrincipalName,JobTitle,Department
# Title prefix OR department, return all pages
Get-MgUser -Filter "startswith(jobTitle,'Engineer') or department eq 'Engineering'" `
-Property Id,DisplayName,UserPrincipalName,JobTitle,Department `
-All |
Select-Object DisplayName,UserPrincipalName,JobTitle,Department3. Export to CSV
Get-MgUser -Filter "department eq 'Engineering'" -All `
-Property Id,DisplayName,UserPrincipalName,JobTitle,Department |
Select-Object DisplayName,UserPrincipalName,JobTitle,Department |
Export-Csv -Path ".\engineers.csv" -NoTypeInformationNotes
- Use
-ConsistencyLevel eventual -CountVariable cfor advanced filters (endsWith,$count). - Run
Disconnect-MgGraphwhen finished on shared machines.
Next steps