Knowing user is part of which groups - Azure DevOps

Question

I have user and I want to know user is part of which groups, is there any powershell command to check that?

Answer 1

Hi tarun k

Yes, you can use PowerShell to check which groups a user belongs to in Azure DevOps.

1. You can use Azure DevOps CLI through PowerShell: Use the following command to list the groups a user belongs to:

      az devops user show --user <user-email> --org <organization-url>
   

   Replace <user-email> with the user's email address and <organization-url> with your Azure DevOps organization URL.
2. If you want a native PowerShell approach using the REST API:

      # Required inputs
      $organization = "your-org-name"
      $project = "your-project-name"  # optional, may be null for org-level
      $userPrincipalName = "user@example.com"
      $pat = "your-pat-token"  # Make sure this has read permissions for Graph API
      # Create auth header
      $base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(":$pat"))
      $headers = @{ Authorization = ("Basic {0}" -f $base64AuthInfo) }
      # Step 1: Get user descriptor
      $userUrl = "https://vssps.dev.azure.com/$organization/_apis/graph/users?api-version=7.1-preview.1"
      $response = Invoke-RestMethod -Uri $userUrl -Headers $headers -Method Get
      $user = $response.value | Where-Object { $_.principalName -eq $userPrincipalName }
      if (-not $user) {
          Write-Host "User not found."
          return
      }
      $descriptor = $user.descriptor
      Write-Host "User descriptor: $descriptor"
      # Step 2: Get groups the user is a member of
      $groupsUrl = "https://vssps.dev.azure.com/$organization/_apis/graph/memberships/$descriptor?direction=up&api-version=7.1-preview.1"
      $groups = Invoke-RestMethod -Uri $groupsUrl -Headers $headers -Method Get
      foreach ($group in $groups.value) {
          $groupDescriptor = $group.containerDescriptor
          # Get group details
          $groupDetailsUrl = "https://vssps.dev.azure.com/$organization/_apis/graph/descriptors/$groupDescriptor?api-version=7.1-preview.1"
          $groupInfo = Invoke-RestMethod -Uri $groupDetailsUrl -Headers $headers -Method Get
          Write-Output "User is a member of group: $($groupInfo.value)"
      }
   

   This will give you a list of group names that the user is a member of. Make sure to replace yourPAT with a valid Personal Access Token and use the correct organization and project details.

Hope this helps!

Please Let me know if you have any queries.

If you found the information helpful, please click "Upvote" on the post to let us know and consider accepting the answer as the token of appreciation. Thank You.