Azure AD - remove disabled users from groups

Question

Azure AD - remove disabled users from groups

Venkatesh M 66

Domain = Hybrid Environment.

Disabled users are in a OU and these users are members of groups.
Groups are created in Azure AD.
How to remove the disabled users from these groups using PowerShell?

Accepted answer

0 additional answers

Your answer

Answer 1

Givary-MSFT 35,621 Microsoft Employee Moderator

@Venkatesh M

Thank you for reaching out to us. As I understand you are looking to remove on-premise disabled users from Azure AD groups ( if my understanding is incorrect, please let me know ).

You can refer to this article https://arconnetblog.wordpress.com/2018/12/07/clean-azure-ad-groups-for-disabled-users/ (similar requirement as yours cleaning up of on-premise disabled users from Azure AD Group).

Note: Please test the script in test environment before implementing in production.

Let me know if you have any further questions.

Venkatesh M 66 Reputation points

2022-06-01T10:49:22.947+00:00

In the blog this part does not understand why twice OU paths. is there any difference ?

$userOUs = @('OU=Leavers,OU=Site1,OU=Contoso Users,DC=Contoso,DC=com','OU=Leavers,OU=Site2,OU=Contoso Users,DC=Contoso,DC=com')
Givary-MSFT 35,621 Reputation points Microsoft Employee Moderator

2022-06-01T11:26:45.24+00:00

@Venkatesh M

Both the OU locations mentioned in the blog are different, one OU is in Site 1 and other one is in Site 2, in your case if you have multiple OU's , test the same with single OU first before implementing in production.
Venkatesh M 66 Reputation points

2022-06-01T12:43:00.433+00:00

Iam running stage by stage the script, the first section went through and have the disabled user in CSV.
In the second stage to fetch users are member of which group, Do I need to use import CSV path ?
As this missing here

$disabled_OnlineMembership = foreach ($user in $disabledUsers) {
if ($user.UserPrincipalName) {
$userObjectId = Get-Msoluser –UserPrincipalName $user.UserPrincipalName | Select-Object –ExpandProperty ObjectId
$group = Get-AzureADUserMembership –ObjectId $userObjectId | Select-Object * | Where-Object {-not ($_.DirSyncEnabled)}
if ($group) {
[pscustomobject]@{
UserName = $user.SamAccountName
DisplayName = $user.Name
Enabled = $user.Enabled
UserDN = $user.DistinguishedName
AADUserObjecID = $userObjectId
GroupName = $group.DisplayName
GroupMail = $group.Mail
AADGroupID = $group.ObjectID
}
}
}
}
Givary-MSFT 35,621 Reputation points Microsoft Employee Moderator

2022-06-01T17:08:38.867+00:00

@Venkatesh M

Remove-AzureADGroupMember : Cannot bind argument to parameter 'MemberId' because it is null. This error is caused by the typo in the script.

In the second script ( of this blog https://arconnetblog.wordpress.com/2018/12/07/clean-azure-ad-groups-for-disabled-users/ ) there is a typo here AADUserObjecID = $userObjectId, it should be AADUserObjectID = $userObjectId due to this we see the error mentioned above.

Looks like you deleted the comment, wanted to check did the entire script solved your purpose of deleting the disabled users from Azure AD group.

Let me know if you have any questions.
Venkatesh M 66 Reputation points

2022-06-01T17:17:32.66+00:00

Finally able to fix some errors in this script and executed it.

create custom object with all the information we require. here
One need to add $disabledUsers=Import-Csv -Path C:\Temp\disabled_users.csv

Remove users from group

Another is syntax fix
Remove-AzureADGroupMember -ObjectId $group -MemberId $onlineUser.AADUserObjecID

Thanks for support and help.
Givary-MSFT 35,621 Reputation points Microsoft Employee Moderator

2022-06-02T03:26:01.663+00:00

@Venkatesh M

Thanks for the update and would be moving this conversation to the answer section.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

Share via

Azure AD - remove disabled users from groups

0 additional answers

Your answer