Microsoft 365 Groups (also known as M365 Groups or Unified Groups) are at the heart of collaboration in Microsoft 365. They power Teams, Outlook Groups, SharePoint sites, Planner, and Yammer.
For IT admins and security researchers, it’s critical to be able to enumerate groups, review their metadata, and audit access. In this updated 2025 guide, we’ll show you how to:
- List all Microsoft 365 Groups in your tenant
- Retrieve key metadata (owners, members, visibility, mail, SharePoint URL, etc.)
- Detect risks (ownerless groups, guest users, hidden memberships)
- Export reports for compliance and governance
We’ll cover two modern approaches:
- PowerShell with Microsoft Graph SDK → best for admins
- Python with Microsoft Graph API → best for researchers & automation
Why Group Enumeration Matters in 2025
- Security & Compliance → Spot ownerless or guest-heavy groups before they become a risk.
- Governance → Identify inactive or duplicate groups for cleanup.
- Visibility → Audit group lifecycles, ownership, and access patterns.
- Modernization → Legacy APIs are deprecated; Graph API is now the standard.
1. Prerequisites
PowerShell (for Admins)
Install the Graph PowerShell SDK:
Install-Module Microsoft.Graph -Scope CurrentUser
Authenticate with MFA support:
Connect-MgGraph -Scopes "Group.Read.All","GroupMember.Read.All"
Python (for Researchers)
Install required packages:
pip install msgraph-core azure-identity
Register an Azure AD app with Group.Read.All and GroupMember.Read.All delegated permissions.
2. Enumerate Microsoft 365 Groups
PowerShell Example
Get-MgGroup -All |
Select-Object Id, DisplayName, Description, Visibility, Mail, CreatedDateTime
Python Example
from msgraph.core import GraphClient
from azure.identity import DeviceCodeCredential
# Authenticate (supports MFA)
credential = DeviceCodeCredential(client_id="YOUR-APP-ID")
client = GraphClient(credential=credential)
# Fetch groups with metadata
groups = client.get("/groups?$select=id,displayName,description,visibility,mail,createdDateTime")
for g in groups.json().get('value', []):
print(f"{g['displayName']} ({g['visibility']}) - {g.get('mail')}")
3. Drill Down into Group Details
Owners & Members (PowerShell)
Get-MgGroupOwner -GroupId <GroupId>
Get-MgGroupMember -GroupId <GroupId>
Owners & Members (Python)
group_id = "<GROUP-ID>"
owners = client.get(f"/groups/{group_id}/owners")
members = client.get(f"/groups/{group_id}/members")
print("Owners:", [o["displayName"] for o in owners.json().get('value', [])])
print("Members:", [m["displayName"] for m in members.json().get('value', [])])
4. Identify Security Risks
Ownerless Groups
Get-MgGroup -All | Where-Object { -not (Get-MgGroupOwner -GroupId $_.Id) }
Groups with Guest Members (PowerShell)
Get-MgGroup -All | ForEach-Object {
$guests = Get-MgGroupMember -GroupId $_.Id | Where-Object {$_.UserType -eq "Guest"}
if ($guests) { Write-Output "$($_.DisplayName) has guest users" }
}
Groups with Guest Members (Python)
for g in groups.json().get('value', []):
members = client.get(f"/groups/{g['id']}/members")
if any(m.get("userType") == "Guest" for m in members.json().get('value', [])):
print(f"Group {g['displayName']} contains guest members")
5. Export Reports
Export to CSV (PowerShell)
Get-MgGroup -All |
Select-Object DisplayName, Visibility, Mail, CreatedDateTime |
Export-Csv GroupsReport.csv -NoTypeInformation
Export to CSV (Python)
import csv
with open("groups_report.csv", "w", newline="") as f:
writer = csv.writer(f)
writer.writerow(["Name", "Visibility", "Mail"])
for g in groups.json().get('value', []):
writer.writerow([g['displayName'], g['visibility'], g.get('mail')])
6. Lifecycle & Governance (Advanced)
Apply Group Lifecycle Policy (PowerShell)
Add-MgGroupToLifecyclePolicy -GroupId <GroupId> -PolicyId <PolicyId>
Check Group Activity (Graph Reports API)
You can call:
/reports/getOffice365GroupsActivityDetail(period='D7')
to detect inactive groups.
Conclusion
Enumerating Microsoft 365 Groups is essential for security, compliance, and governance. Using PowerShell or Python with Microsoft Graph lets you quickly list groups, audit memberships, and detect risks like ownerless or guest-heavy groups. Always use an Azure AD app with the right permissions (Group.Read.All
and GroupMember.Read.All
) for secure and reliable access.