Clearing up user group membership using PowerShell Graph API Remove-MgGroupMemberByRef ?

Question

Using the latest PowerShell Graph API, how can I remove Azure AD group members from a user account?

The input will be user principal name, and the command will be using Remove-MgGroupMemberByRef cmdlet: https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.groups/remove-mggroupmemberbyref?view=graph-powershell-1.0&preserve-view=true

Answer 1

Hi @EnterpriseArchitect

The Remove-MgGroupMemberByRef command of the Graph PowerShell SDK doesn't work for me, even though I already have the latest graph groups module, not sure if this is an unknown issue.

As an alternative solution, I use PowerShell online to call the API endpoint directly, and it works fine for me. Reference:

  $clientID = 'client id'       
  $secretKey = 'client secret'      
  $tenantID = 'tenant id'                   
  $authUrl = "https://login.microsoftonline.com/" + $tenantID + "/oauth2/v2.0/token/"      
  $body = @{       
      "scope" = "https://graph.microsoft.com/.default";       
      "grant_type" = "client_credentials";       
      "client_id" = $ClientID       
      "client_secret" = $secretKey       
  }  
          
  $authToken = Invoke-RestMethod -Uri $authUrl –Method POST -Body $body                   
  $url = "https://graph.microsoft.com/v1.0/groups/{group id}/members/{member object id}/`$ref"     
  $headers = @{       
  "Authorization" = "Bearer $($authToken.access_token)"  
   "Content-type"  = "application/json"       
  }       
Invoke-RestMethod -Uri $url -Headers $headers -Method Delete  

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi @EnterpriseArchitect , sorry for the late reply.

I can do this using the Graph C# SDK, but your users can't be members of dynamic groups or you'll get an error.

using Azure.Identity;   
using Microsoft.Graph;  
  
  
try  
{  
  
 var scopes = new[] { "https://graph.microsoft.com/.default" };  
  
 var tenantId = "tenant id";  
  
 // Values from app registration  
 var clientId = "client id";  
 var clientSecret = "client secret";  
  
 // using Azure.Identity;  
 var options = new TokenCredentialOptions  
{  
      AuthorityHost = AzureAuthorityHosts.AzurePublicCloud  
};  
  
 // https://learn.microsoft.com/dotnet/api/azure.identity.clientsecretcredential  
 var clientSecretCredential = new ClientSecretCredential(  
      tenantId, clientId, clientSecret, options);  
  
      var graphClient = new GraphServiceClient(clientSecretCredential, scopes);  
  
      var memberOf = await graphClient.Users["user object id"].MemberOf.Request().GetAsync();  
  
      for (int i = 0; i < memberOf.Count; i++)  
      {  
  
            var groupId = memberOf[i].Id.ToString();  
  
            await graphClient.Groups[groupId].Members["user object id"].Reference.Request().DeleteAsync();  
  
      }  
}  
catch (Exception ex) {   
  
      Console.WriteLine(ex);  
}  

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.