Azure AD groups export created by me.

Question

Hello Team,

Please provide me the powershell command to get all Azure Active Directory groups (AAD - groups) created by me.

Your help will be appreciated.

Answer 1

Hi @Gurudas ,

this is only possible if Active Directory Auditing has been enabled. Then an event is written to the Security event Log on a domain controller.
So, if you have enabeld this, you need to get all AD groups and search for a Audting event, which references this group, then check who the Creator of the group is.
It is not an trivial task to achieve.

Here is also how Auditing can be enabled in Active Directory:

How to Enable the Security Auditing of Active Directory
https://www.lepide.com/how-to/enable-active-directory-security-auditing.html

and here is an example of how to find a user account in AD, created by a specific user, the logic for groups is the similar:

How to Check Who Created a User Account in AD?
http://woshub.com/getting-ad-accounts-created-in-the-last-24-hours/

instead of using "Get-ADUser" you need to use "Get-ADGroup", the rest is the same...

Here is a reference to the event, a post from the forums:

Powershell - Identify the user account who has created accounts in AD
https://learn.microsoft.com/en-us/answers/questions/412084/powershell-identify-the-user-account-who-has-creat.html

Hope I could help you out!

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)
Regards
Stoyan Chalakov

Answer 2

Hello there,

I found the script in an article to list azure AD groups for a user using the Powershell

Get-AzureADUser -SearchString *************** | Get-AzureADUserMembership | % {Get-AzureADObjectByObjectId -ObjectId $_.ObjectId | select DisplayName,ObjectType,MailEnabled,SecurityEnabled,ObjectId} | ft

Where the *************** is the UPN of who you want to search, this will return all groups aside from Dynamic groups.

You can find the thread here https://techcommunity.microsoft.com/t5/azure/how-to-list-azure-ad-groups-for-a-user-using-power-shell/m-p/1603583

-----------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer–