How to Bulk Import CSV to create Security Groups and Add Groups Owner to those Groups Using Powershell in Azure AD

Question

How to Bulk Import CSV to create Security Groups and Add Groups Owner to those Groups Using Powershell in Azure AD

Mourya, Aditya 21

I am Looking for an Script where i can create 500 Security Groups by Bulk Import Power shell cmdlet and Add Group Owners in Azure AD at the same time .

Please help !!!

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

7 answers

Your answer

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 1

Mourya, Aditya 21

It seems It is working now and thank so much for your help and for your prompt replies ..

Andreas Baumgarten 120.4K Reputation points MVP

2022-09-18T17:28:58.943+00:00

Hi @Mourya, Aditya ,

great to hear.

It's my first script that is working after I modified it (to get rid of my mistake)?
If you found the answer containing my first script helpful, it would be great if you please mark it "Accept as answer". This will help others to find answers in Q&A

----------

Regards
Andreas Baumgarten
JamesTran-MSFT 36,871 Reputation points Microsoft Employee

2022-09-20T17:51:28.2+00:00

@Mourya, Aditya
I'm glad that you were able to resolve your issue!

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Answer 2

Andreas Baumgarten 120.4K MVP

Hi @Mourya, Aditya ,

maybe this helps to get started: https://morgantechspace.com/2021/12/create-security-group-and-add-members-in-azure-ad-using-powershell.html

Do you have a CSV file with the names of the new AD groups and the related AD user (owner)?

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten

Mourya, Aditya 21 Reputation points

2022-09-18T06:33:24.487+00:00

@Andreas Baumgarten Thank you for sharing the URLs but it didn't helped with my Question .

I want to Create New Azure AD Security Groups by Importing CSV File and also add Group Owners .

Could you please help me with cmdlet or Script .?

MY CSV file contains Parameters - GroupName ,GroupOwner email address .
Andreas Baumgarten 120.4K Reputation points MVP

2022-09-18T09:34:24.823+00:00
Hi @Mourya, Aditya ,

this is a very simple script without any error handling to get the job done:

Import-Csv -Path "Junk\AzureADgroups.csv" | ForEach-Object { $ownerUserObj = Get-AzureADUser -ObjectId $_.GroupOwner $newGroup = New-AzureADGroup -DisplayName $_.GroupName -SecurityEnabled $true -MailEnabled $false -MailNickName "NotSet" Add-AzureADGroupOwner -ObjectId $newGroup.ObjectId -RefObjectId $ownerUserObj.ObjectId }

CSV file looks like this:

GroupName,GroupOwner groupPeter,******@contoso.com groupPaul,******@contoso.com

I would recommend to add some error handling to the script:
"Owner does not exist" and "Group name already exists" with the required output. For instance:

If owner user object does not exists don't create the group

If the group name already exists don't create the group with the same name

But this is up to your requirements.

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten
Mourya, Aditya 21 Reputation points

2022-09-18T12:41:38.56+00:00

I Tried creating Security Groups but got the attached Error ,Please assist .

I used the Parameters : GroupName , GroupOwner (emails addresses )
Mourya, Aditya 21 Reputation points

2022-09-18T12:50:29.82+00:00

@Andreas Baumgarten ,Please help Me
Andreas Baumgarten 120.4K Reputation points MVP

2022-09-18T13:00:04.097+00:00

Hi @Mourya, Aditya ,

please take a look on the CSV file content I posted in my answer including the first line with the header details.
How does your CSV file content looks like? It should look like the same (try to avoid spaces in the column header).

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten
Mourya, Aditya 21 Reputation points

2022-09-18T13:07:00.423+00:00

Please see attached my CSV file contain.. these header

@Andreas Baumgarten
Andreas Baumgarten 120.4K Reputation points MVP

2022-09-18T13:10:41.697+00:00
Hi @Mourya, Aditya ,

please post the output of this line (replace <yourCSVfileName.csv> with the name of your CSV file):

Import-Csv -Path "<yourCSVfileName.csv>"

You should see 2 lines.

If so please try this:

Import-Csv -Path "<yourCSVfileName.csv>" | ForEach-Object { $_.GroupOwner $_.GroupName }

You should see 4 lines ...

Owner1 (line 2 in your CSV)
Group1 (line 2 in your CSV)
Owner2 (line 3 in your CSV)
Group2 (line 3 in your CSV)

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten
Mourya, Aditya 21 Reputation points

2022-09-18T13:15:14.867+00:00

Import-Csv -Path "c:\temp\GroupsC.csv" | ForEach-Object {
$ownerUserObj = $UserObj = Get-AzureADUser -ObjectId $.GroupOwner
$newGroup = New-AzureADGroup -DisplayName $.GroupName -SecurityEnabled $true -MailEnabled $false -MailNickName "NotSet"
Add-AzureADGroupOwner -ObjectId $newGroup.ObjectId -RefObjectId $ownerUserObj.ObjectId
}
Mourya, Aditya 21 Reputation points

2022-09-18T13:27:55.177+00:00

I Used this Below cmdlet but get the same error as shared earlier :

Import-Csv -Path "C:\temp\GroupsC.csv" | ForEach-Object {
$ownerUserObj = $UserObj = Get-AzureADUser -ObjectId $.GroupOwner
$newGroup = New-AzureADGroup -DisplayName $.GroupName -SecurityEnabled $true -MailEnabled $false -MailNickName "NotSet"
Add-AzureADGroupOwner -ObjectId $newGroup.ObjectId -RefObjectId $ownerUserObj.ObjectId
}

Andreas Baumgarten 120.4K MVP

I made a minor mistake in the script. Sorry!

Please try this:

Import-Csv -Path "c:\temp\GroupsC.csv" | ForEach-Object {  
$ownerUserObj = Get-AzureADUser -ObjectId $_.GroupOwner  
$newGroup = New-AzureADGroup -DisplayName $_.GroupName -SecurityEnabled $true -MailEnabled $false -MailNickName "NotSet"  
Add-AzureADGroupOwner -ObjectId $newGroup.ObjectId -RefObjectId $ownerUserObj.ObjectId  
}

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten

Answer 3

Vinodh247 32,366 MVP

Hi Mourya,

Thanks for reaching out to Microsoft Q&A.

Please refer the below links, these has directions and steps.

https://stackoverflow.com/questions/31528764/powershell-import-csv-to-add-active-directory-security-groups

https://social.technet.microsoft.com/wiki/contents/articles/19177.powershell-script-to-add-users-to-group-from-csv-file-based-on-decision-control.aspx

EDIT

Please ignore the links above as it is related to Azure AD on-prem, I suggest you to refer the link posted by @Andreas Baumgarten

Please Upvote and Accept as answer if the reply was helpful.

Andreas Baumgarten 120.4K Reputation points MVP

2022-09-17T12:10:44.417+00:00

Hi @Vinodh247 ,

Just for info: Both links you posted in your answer are related to Active Directory (on premises AD) and not related to Azure Active Directory (AAD).
The question was related to Azure AD as far as I understand.

Bulk Import Power shell cmdlet and Add Group Owners in Azure AD

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten
Vinodh247 32,366 Reputation points MVP

2022-09-18T06:12:11.7+00:00

Hi @Andreas Baumgarten : Thanks for correction, I have edited my answer now.

Answer 4

Andreas Baumgarten 120.4K MVP

There is a minor mistake in the script. Sorry!

Please try this:

Import-Csv -Path "c:\temp\GroupsC.csv" | ForEach-Object {  
$ownerUserObj = Get-AzureADUser -ObjectId $_.GroupOwner  
$newGroup = New-AzureADGroup -DisplayName $_.GroupName -SecurityEnabled $true -MailEnabled $false -MailNickName "NotSet"  
Add-AzureADGroupOwner -ObjectId $newGroup.ObjectId -RefObjectId $ownerUserObj.ObjectId  
}

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten

Andreas Baumgarten 120.4K Reputation points MVP

2022-09-19T21:53:30.387+00:00

Hi @Mourya, Aditya ,

you wrote earlier the script is working now for you.

If you found the answer helpful, it would be great if you please mark it "Accept as answer". This will help others to find answers in Q&A

Regards
Andreas Baumgarten

Answer 5

Mourya, Aditya 21

Still No Luck ,Got this Error ...

Get-AzureADUser : Cannot bind argument to parameter 'ObjectId' because it is an empty string.
At line:2 char:44

$ownerUserObj = Get-AzureADUser -ObjectId $_.GroupOwner
~~~~~~~~~~~~~
CategoryInfo : InvalidData: (:) [Get-AzureADUser], ParameterBindingValidationException
FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAllowed,Microsoft.Open.AzureAD16.PowerShell.GetUser

New-AzureADGroup : Cannot bind argument to parameter 'DisplayName' because it is an empty string.
At line:3 char:44

$newGroup = New-AzureADGroup -DisplayName $_.GroupName -SecurityEnab ...
~~~~~~~~~~~~
CategoryInfo : InvalidData: (:) [New-AzureADGroup], ParameterBindingValidationException
FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAllowed,Microsoft.Open.AzureAD16.PowerShell.NewGroup

Add-AzureADGroupOwner : Error occurred while executing AddGroupOwner
Code: Request_BadRequest
Message: One or more added object references already exist for the following modified properties: 'owners'.
RequestId: e2945e74-a689-4209-b8ea-2110bb370b37
DateTimeStamp: Sun, 18 Sep 2022 13:44:28 GMT
HttpStatusCode: BadRequest
HttpStatusDescription: Bad Request
HttpResponseStatus: Completed
At line:4 char:2

Add-AzureADGroupOwner -ObjectId $newGroup.ObjectId -RefObjectId $own ...
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CategoryInfo : NotSpecified: (:) [Add-AzureADGroupOwner], ApiException
FullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.AddGroupOwner

Get-AzureADUser : Cannot bind argument to parameter 'ObjectId' because it is an empty string.
At line:2 char:44

$ownerUserObj = Get-AzureADUser -ObjectId $_.GroupOwner
~~~~~~~~~~~~~
CategoryInfo : InvalidData: (:) [Get-AzureADUser], ParameterBindingValidationException
FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAllowed,Microsoft.Open.AzureAD16.PowerShell.GetUser

New-AzureADGroup : Cannot bind argument to parameter 'DisplayName' because it is an empty string.
At line:3 char:44

$newGroup = New-AzureADGroup -DisplayName $_.GroupName -SecurityEnab ...
~~~~~~~~~~~~
CategoryInfo : InvalidData: (:) [New-AzureADGroup], ParameterBindingValidationException
FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAllowed,Microsoft.Open.AzureAD16.PowerShell.NewGroup

Add-AzureADGroupOwner : Error occurred while executing AddGroupOwner
Code: Request_BadRequest
Message: One or more added object references already exist for the following modified properties: 'owners'.
RequestId: 82b8d083-4ebd-44b5-b964-470111693e20
DateTimeStamp: Sun, 18 Sep 2022 13:44:28 GMT
HttpStatusCode: BadRequest
HttpStatusDescription: Bad Request
HttpResponseStatus: Completed
At line:4 char:2

Add-AzureADGroupOwner -ObjectId $newGroup.ObjectId -RefObjectId $own ...
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CategoryInfo : NotSpecified: (:) [Add-AzureADGroupOwner], ApiException
FullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.AddGroupOwner

Andreas Baumgarten 120.4K Reputation points MVP

2022-09-18T13:47:37.867+00:00
Please post the output of this command:

Import-Csv -Path "c:\temp\GroupsC.csv"

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten
Mourya, Aditya 21 Reputation points

2022-09-18T13:51:45.183+00:00

i Get this Output on running this cmdlet

PS C:\Windows\system32> Import-Csv -Path "C:\temp\GroupsC.csv"

GroupName GroupOwner
--------- ----------
TeamGroup ******@group.com
ClubGroup ******@group.com
Andreas Baumgarten 120.4K Reputation points MVP

2022-09-18T14:01:12.41+00:00
Please try this and poist the output:

Import-Csv -Path "C:\temp\GroupsC.csv" | ForEach-Object { $_.GroupOwner $_.GroupName }

You should get the 4 lines ...
******@group.com
TeamGroup
******@group.com
ClubGroup

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten
Mourya, Aditya 21 Reputation points

2022-09-18T14:05:30.173+00:00

Please find the OutPut :

PS C:\Windows\system32> Import-Csv -Path "C:\temp\GroupsC.csv" | ForEach-Object {
$.GroupOwner
$.GroupName
}

******@group.com
TeamGroup
******@group.com
ClubGroup
Andreas Baumgarten 120.4K Reputation points MVP

2022-09-18T14:08:22.833+00:00
Next with output please:

Import-Csv -Path "C:\temp\GroupsC.csv" | ForEach-Object { Get-AzureADUser -ObjectId $_.GroupOwner }

You should get 2 lines.

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten
Mourya, Aditya 21 Reputation points

2022-09-18T14:12:34.597+00:00
I get this Error after running this - Import-Csv -Path "C:\temp\GroupsC.csv" | ForEach-Object {
Get-AzureADUser -ObjectId $_.GroupOwner
}

Get-AzureADUser : Cannot bind argument to parameter 'ObjectId' because it is an empty string.
At line:2 char:32

Get-AzureADUser -ObjectId $_.GroupOwner

~~~~~~~~~~~~~

CategoryInfo : InvalidData: (:) [Get-AzureADUser], ParameterBindingValidationException

FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAllowed,Microsoft.Open.AzureAD16.PowerShell.GetUser

Get-AzureADUser : Cannot bind argument to parameter 'ObjectId' because it is an empty string.
At line:2 char:32

Get-AzureADUser -ObjectId $_.GroupOwner

~~~~~~~~~~~~~

CategoryInfo : InvalidData: (:) [Get-AzureADUser], ParameterBindingValidationException

FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAllowed,Microsoft.Open.AzureAD16.PowerShell.GetUser
Andreas Baumgarten 120.4K Reputation points MVP

2022-09-18T14:32:48.627+00:00
This is weird .....

Please run each line and post each output:

($PSVersionTable).PSVersion Get-InstalledModule AzureAD | Select-Object Name, Version, Repository Import-Module AzureAD # This will not give an output Get-Module AzureAD | Select-Object Name, Version (Get-AzureADCurrentSessionInfo).Account

Please verify the user of the last output is a member of the Global Administrator role in your Azure AD.

Also you could run the following command with using your Azure AD Account:

Get-AzureADUser -ObjectId "******@group.com"

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten
Mourya, Aditya 21 Reputation points

2022-09-18T14:48:15.667+00:00

Please find the result :

PS C:\Windows\system32> ($PSVersionTable).PSVersion
Get-InstalledModule AzureAD | Select-Object Name, Version, Repository

Major Minor Build Revision
----- ----- ----- --------
5 1 19041 1682

Name : AzureAD
Version : 2.0.2.140
Repository : PSGallery

Import-Module AzureAD

PS C:\Windows\system32> Import-Module AzureAD

PS C:\Windows\system32> Get-Module AzureAD | Select-Object Name, Version
(Get-AzureADCurrentSessionInfo).Account

Name Version
---- -------
AzureAD 2.0.2.140
Andreas Baumgarten 120.4K Reputation points MVP

2022-09-18T14:50:45.17+00:00
What happens if you please run this now (using your Azure AD account as the ObjectId)?

Get-AzureADUser -ObjectId "******@group.com"

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten
Mourya, Aditya 21 Reputation points

2022-09-18T14:57:24.703+00:00

I Get this Result :

PS C:\Windows\system32> Get-AzureADUser -ObjectId ******@group.com

ObjectId DisplayName UserPrincipalName UserType
-------- ----------- ----------------- --------
bffsdffc8-43482-4434a-9343a-44555sd Mourya, Aditya ******@group.com Member
Andreas Baumgarten 120.4K Reputation points MVP

2022-09-18T15:14:09.113+00:00
Next try please:

Import-Csv -Path "C:\temp\GroupsC.csv" | ForEach-Object { Write-Output "Owner: $($_.GroupOwner)" $ownerUserObj = Get-AzureADUser -ObjectId ($_.GroupOwner).Trim() $ownerUserObj }

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten
Mourya, Aditya 21 Reputation points

2022-09-18T15:29:20.523+00:00
I Get this Error :

Get-AzureADUser : Cannot bind argument to parameter 'ObjectId' because it is an empty string.
At line:3 char:48

$ownerUserObj = Get-AzureADUser -ObjectId ($_.GroupOwner).Trim()

~~~~~~~~~~~~~~~~~~~~~~

CategoryInfo : InvalidData: (:) [Get-AzureADUser], ParameterBindingValidationException

FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAllowed,Microsoft.Open.AzureAD16.PowerShell.GetUser

36d58f5f-d54a-4493-a1a6-b57915cfe624 Mourya,Aditya ******@group.com Member
Owner:

Share via

How to Bulk Import CSV to create Security Groups and Add Groups Owner to those Groups Using Powershell in Azure AD

7 answers

Your answer