👥 Recipe · User & Group Management

List a User's Group Memberships in Entra ID via Microsoft Graph

Audit which security groups, Microsoft 365 groups, and directory roles a user belongs to

Complexity

Beginner

Impact

read-only + audit + access-review + low-risk

Context

Why This Matters

Knowing exactly which groups a user belongs to is foundational for access reviews, offboarding, troubleshooting permission issues, and license audits. In Entra ID (formerly Azure AD), a user's memberOf collection returns both group memberships (security groups, Microsoft 365 groups, distribution lists, dynamic groups) and directory role assignments in a single call.

Run this recipe when you need to:

Investigate why a user has (or lacks) access to a resource
Document group memberships before offboarding or role changes
Identify unexpected privileged role assignments
Verify dynamic group rules are assigning users correctly
Support compliance or access-review requirements

Expected Outcomes

After completing this recipe you will have:

A complete list of groups the target user belongs to, including display names, IDs, and descriptions
Visibility into any directory role assignments (e.g., Global Administrator, User Administrator)
A repeatable method — GUI, API, or PowerShell — for answering the same question for any user
Optionally, an exportable CSV of memberships for reporting or audit evidence

Risks & Considerations

Things to watch for

Direct vs transitive membership: /memberOf returns only direct memberships. Use /transitiveMemberOf to include nested group membership.
Mixed object types: The response contains both #microsoft.graph.group and #microsoft.graph.directoryRole objects. Filter by @odata.type if you only want groups.
Null display names: Directory roles often return null for displayName when using $select. Remove the $select or include it in the projection to get role names.
Permissions: Reading another user's memberships requires at minimum GroupMember.Read.All or Directory.Read.All.
PII / least privilege: Group memberships can reveal organizational structure. Limit who can run these queries at scale.

Required Permissions

Permission	Why It's Needed
User.Read.All	Read the target user object to resolve UPN or object ID
GroupMember.Read.All	Read the groups a user is a member of
Directory.Read.All	Alternative broader permission; also returns directory role assignments
RoleManagement.Read.Directory	Read directory role details when resolving role names

The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.

For IT Admins

Paste into Dex Pro

List all group memberships and directory role assignments for {user} in Entra ID. Include both direct and transitive memberships, and flag any privileged roles.

Try in Dex Pro

For End Users

How an employee would ask Dex for help

Which distribution lists and Teams groups am I a member of?

Try in Dex Playground

List group memberships via the Entra admin center

Sign in to the Microsoft Entra admin center at https://entra.microsoft.com with an account that has at least Directory Readers or Global Reader.
Navigate to Identity → Users → All users.
Search for the target user by display name or UPN (e.g., user@contoso.com) and click the user to open their profile.
In the left pane of the user blade, select Groups. This lists all direct group memberships (security groups, M365 groups, distribution lists).
To see nested (transitive) memberships, check the Membership type column or use the Include indirect (transitive) memberships toggle if available.
To view privileged role assignments separately, go to Identity → Roles & admins → All assignments and filter by the user's UPN, or open the user profile and select Assigned roles.
Click Download (if present) to export the group list to CSV for documentation.

Tip: The Microsoft 365 admin center (https://admin.microsoft.com) also shows group memberships under Users → Active users → [user] → Groups, but the Entra portal gives more detail on membership type and source.

Query `/memberOf` via Microsoft Graph

Use the memberOf relationship on the user resource. Replace {userPrincipalName} with the target UPN or object ID.

Direct memberships

GET https://graph.microsoft.com/v1.0/users/{userPrincipalName}/memberOf?$select=id,displayName,description
Authorization: Bearer <access_token>

Transitive (includes nested groups)

GET https://graph.microsoft.com/v1.0/users/{userPrincipalName}/transitiveMemberOf?$select=id,displayName,description

Example response

{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#directoryObjects(id,displayName,description)",
  "value": [
    {
      "@odata.type": "#microsoft.graph.group",
      "id": "a1b2c3d4-...",
      "displayName": "Finance Team",
      "description": "Finance department distribution group"
    },
    {
      "@odata.type": "#microsoft.graph.directoryRole",
      "id": "3e48a46f-461c-4a4a-bd75-f2789f7f939f",
      "displayName": null,
      "description": null
    }
  ]
}

Filtering to groups only

GET https://graph.microsoft.com/v1.0/users/{userPrincipalName}/memberOf/microsoft.graph.group?$select=id,displayName,description,groupTypes,securityEnabled

Notes

Remove $select or explicitly include role fields to get full directory role names.
The endpoint returns a maximum of 100 objects per page — follow @odata.nextLink for pagination.
Use ConsistencyLevel: eventual header plus $count=true for advanced queries.

List memberships with Microsoft Graph PowerShell

Uses the Microsoft.Graph PowerShell SDK. Install once with Install-Module Microsoft.Graph -Scope CurrentUser.

Connect

Connect-MgGraph -Scopes "User.Read.All","GroupMember.Read.All","Directory.Read.All"

Get direct memberships

$upn = "user@contoso.com"
Get-MgUserMemberOf -UserId $upn -All |
  Select-Object @{N='Type';E={$_.AdditionalProperties['@odata.type']}},
                @{N='DisplayName';E={$_.AdditionalProperties['displayName']}},
                Id

Get transitive (nested) memberships

Get-MgUserTransitiveMemberOf -UserId $upn -All

The AdditionalProperties hashtable is where display name, description, and object type live because the Graph SDK deserializes to the base DirectoryObject type.

Next steps

More User & Group Management recipes

Browse the rest of this category in the Dex Cookbook.

Automate this with Dex Pro

Let the autonomous IT engineer run this task under your policies.

Start free

Point Dex at a tenant and try it for 30 days, no credit card.