Hi, how do I check Azure AD Security group usage - a listing of groups in a tenant, and where they are used, Teams, SPI, RBAC groups, Enterprise Apps etc

Question

Hi, how do I check Azure AD Security group usage - a listing of groups in a tenant, and where they are used, Teams, SPI, RBAC groups, Enterprise Apps etc

Answer 1

Hello @Nesisa Chimboza ,

Thanks for reaching out.

There's no direct way to get usage information because Azure AD doesn't maintains usage information. Alternatively, you could use some custom script which includes respective services cmdlets such as Azure AD Application, Azure RBAC, Teams etc..,

As a result, use the Get-AzureADGroup cmdlet to retrieve the Group objectID and then build your own logic to look up the below cmdlets to find out which services have group enabled. Please see the samples below for your reference:

**Retrieve RBAC role assignments for a group: **
Get-AzRoleAssignment | where {$_.ObjectId -like "{Group Object ID}"}
Reference: https://learn.microsoft.com/en-us/powershell/module/az.resources/get-azroleassignment?view=azps-7.2.0

**Retrieve application role assignments of a group: **
$GroupId = (Get-AzureADGroup -Top 1).ObjectId
Get-AzureADGroupAppRoleAssignment -ObjectId $GroupId

The first command gets the object ID of a group by using the Get-AzureADGroup (./Get-AzureADGroup.md)cmdlet. The command stores the ID in the $GroupId variable. The second command gets the application role assignments of the group in $GroupId.
Reference: https://learn.microsoft.com/en-us/powershell/module/azuread/get-azureadgroupapproleassignment?view=azureadps-2.0#example-1--retrieve-application-role-assignments-of-a-group

**Retrieve team-enabled groups: **
Get-Team -GroupId {Group Object ID}
Reference: https://learn.microsoft.com/en-us/powershell/module/teams/get-team?view=teams-ps

**Using Get-UnifiedGroup to Find Teams: **
Get-UnifiedGroup -Filter {ResourceProvisioningOptions -eq "Team"} -ResultSize Unlimited

**Finding Yammer-Enabled Groups: **
Get-UnifiedGroup -ResultSize Unlimited |?{$_.GroupSku -eq "Yammer"}

Hope this helps.

-----
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.