👥 Recipe · User & Group Management
Remove a User from a Microsoft 365 / Entra ID Group
Revoke group membership cleanly across GUI, Graph API, and PowerShell
Complexity
Beginner
Impact
access-control + offboarding + group-management + least-privilege
Context
Why This Matters
Group membership in Microsoft 365 / Entra ID drives access to shared mailboxes, Teams, SharePoint sites, licenses (via group-based licensing), and Conditional Access policy scope. When a user changes roles, leaves a team, or is offboarded from a specific business function, removing them from the appropriate group is a standard access-hygiene task.
This recipe covers removing a single user from a single group — the most common helpdesk request. It applies equally to security groups, Microsoft 365 groups, and mail-enabled security groups. It does not cover dynamic groups (membership there is rule-based and cannot be edited directly) or on-premises-synced groups (those must be edited in on-prem Active Directory).
Expected Outcomes
- The specified user is no longer a member of the specified group.
- Any group-delivered access (shared resources, licenses assigned via group, CA policy scope) is revoked on the next token refresh.
- An audit trail entry exists in the Entra audit log showing who performed the removal and when.
Risks & Considerations
Before you remove
- Confirm the group source. If the group is synced from on-premises AD (
onPremisesSyncEnabled = true), the change must be made in AD — cloud-side removals will be overwritten at the next sync cycle. - Dynamic groups cannot be edited manually. If the group has a membership rule, you must change the user's attributes (e.g., department) so they no longer match the rule.
- Group-based licensing. If the group assigns a license, removing the user may immediately revoke that license. Confirm the user has alternate license coverage if they still need the service.
- Last owner rule. For Microsoft 365 groups, do not remove the only remaining owner without assigning a replacement — the group becomes unmanaged.
- Token latency. Access revocation is not instantaneous. Existing tokens remain valid for up to an hour. For urgent revocation (e.g., termination), also revoke the user's refresh tokens.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| GroupMember.ReadWrite.All | Required to remove members from Entra ID groups via Microsoft Graph. |
| Group.ReadWrite.All | Alternative higher-scope permission covering full group management. |
| Groups Administrator (role) | Least-privilege Entra role for admins performing group membership changes in the portal. |
The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex Pro
For End Users
How an employee would ask Dex for help
Remove a user from a group via the Entra admin center
- Sign in to the Microsoft Entra admin center as a Groups Administrator, User Administrator, or Global Administrator.
- Navigate to .
- In the search box, type the group name (e.g.,
Retail) and select the group from the results. - Under , use the search filter to find the user (e.g.,
israel@contoso.onmicrosoft.com). - Check the box next to the user's name, then click Remove at the top of the list.
- Confirm the prompt. The user is removed immediately from the cloud group.
Verification
- Refresh the members list and confirm the user is no longer present.
- Go to and confirm the group no longer appears in their membership list.
- Review — filter by Activity: Remove member from group to see the audit entry.
If the Remove button is greyed out
The group is either dynamic (check the Membership type on the Overview blade) or synced from on-premises AD (check Source). Neither can be edited from the cloud portal.
Remove a group member using Microsoft Graph
The Graph endpoint for removing a member is a DELETE against the member reference on the group.
1. Resolve the group ID (if you only have the display name)
GET https://graph.microsoft.com/v1.0/groups?$filter=displayName eq 'Retail'&$select=id,displayName,onPremisesSyncEnabled,groupTypesInspect the response — if onPremisesSyncEnabled is true, stop and make the change in on-prem AD instead.
2. Resolve the user ID
GET https://graph.microsoft.com/v1.0/users/israel@contoso.onmicrosoft.com?$select=id,displayName3. Remove the member
DELETE https://graph.microsoft.com/v1.0/groups/{group-id}/members/{user-id}/$ref
Authorization: Bearer <access_token>A successful removal returns 204 No Content. Common error responses:
404 Not Found— the user is not a member of the group (idempotent outcome; safe to treat as success).403 Forbidden— caller lacksGroupMember.ReadWrite.Allor the group is protected by a role-assignable policy requiring Privileged Role Administrator.400 Bad Requestwith Unable to update the specified properties for objects that have originated within an external service — the group is synced from on-prem AD.
4. Verify
GET https://graph.microsoft.com/v1.0/groups/{group-id}/members?$filter=id eq '{user-id}'An empty value array confirms removal.
Remove a group member with Microsoft Graph PowerShell
This uses the official Microsoft.Graph module, which is the supported successor to the deprecated AzureAD and MSOnline modules.
Prerequisites
- PowerShell 7+ recommended.
- Install the module:
Install-Module Microsoft.Graph -Scope CurrentUser - Connect with the required scope:
Connect-MgGraph -Scopes "GroupMember.ReadWrite.All"
Step-by-step
- Connect to Graph and consent to the scope when prompted.
- Resolve the group and user by their identifiers (UPN for user, display name for group).
- Safety-check the group source — abort if it is synced from on-prem or dynamic.
- Call
Remove-MgGroupMemberByRefto perform the removal. - Verify by re-querying the membership.
The downloadable script below wraps all of this with parameters, validation, and structured output so it can be run ad-hoc or from a ticketing workflow.
Next steps