在 Microsoft Entra ID 中批量添加组成员

项目
07/18/2024

可以使用逗号分隔值 (CSV) 文件将多个成员添加到组，以便在 Microsoft Entra ID 的门户中批量导入组成员。

了解 CSV 模板

要成功地批量添加 Microsoft Entra 组成员，请下载并填写“批量上传 CSV”模板。 CSV 模板可能如下例所示：

屏幕截图显示了用于上传的电子表格，以及解释每一行和每一列的用途和值的注释。

CSV 模板结构

下载的 CSV 模板中的行如下所示：

版本号：包含版本号的第一行必须包含在上传的 CSV 中。
列标题：列标题的格式为：<项名称> [PropertyName] <必需或空白>。示例为 Member object ID or user principal name [memberObjectIdOrUpn] Required。某些较旧版本的模板可能会略有不同。对于组成员身份更改，可以选择成员对象 ID 或用户主体名称。
示例行：模板包含了一行示例，展示了每个列的可接受值。必须删除示例行并将其替换为你自己的项。

批量导入组成员

提示

本文中的步骤可能因开始使用的门户而略有不同。

至少以组管理员身份登录到 Microsoft Entra 管理中心。
选择“Microsoft Entra ID”。

注意

组所有者还可批量导入其拥有的组的成员。
选择“组”>“所有组” 。
打开要向其添加成员的组，然后选择“成员”。
在“成员”页上，选择“批量操作”，然后选择“导入成员”。
在“批量导入组成员”页面上，选择“下载”以获取具有所需组成员属性的 CSV 文件模板。
打开 CSV 文件，为要导入到组中的每个组成员添加一行。所需值为“成员对象 ID”或“用户主体名称”。然后保存文件。
在“批量导入组成员”页面上的“上传 csv 文件”下，浏览到该文件。选择 CSV 文件后立即开始对它的验证。
验证文件内容后，批量导入页将显示“已成功上传文件”。如果有错误，必须修正错误，然后才能提交作业。
当文件通过验证时，选择“提交”，开始将组成员导入到组的批量操作。
导入操作完成后，会显示一条通知，提示批量操作成功。

如果遇到错误，可以在“批量操作结果”页下载并查看结果文件。该文件包含每个错误的原因。文件提交必须与提供的模板匹配，并包含确切的列名称。有关批量操作限制的详细信息，请参阅批量导入服务限制。

查看导入状态

可在“批量操作结果”页面中查看所有挂起的批量请求的状态。

显示“批量操作结果”页上的“检查状态”选项的屏幕截图。

要详细了解批量操作中每个行项，请选择“成功数”、“失败数”或“请求总数”列下的值。如果失败，则会列出失败原因。

“批量导入”服务限制

应注意，每个批量操作活动最多可以运行一小时。

Microsoft Entra 管理门户中的批量操作可能会超时，并可能在非常大的租户上失败。此限制是一个由缩放限制导致的已知问题。 Microsoft 工程团队正在研究一项最终将解决此限制的新服务。

注意

执行批量操作（如导入或创建）时，如果批量操作未在一小时内完成，则可能是遇到了问题。若要解决此问题，建议拆分每批处理的记录数。例如，在开始导出之前，可以通过筛选组类型或用户名来限制结果集，以减少结果的大小。通过优化筛选器，实质上你是在限制批量操作返回的数据。

此问题的另一种解决方法是使用 PowerShell 直接进行 Microsoft Graph API 调用。对于批量下载用户和组失败，我们建议使用 PowerShell cmdlet GET-MgGroup -All 和 GET-MgUser -All。

以下 PowerShell 代码示例适用于与以下场景相关的批量操作：

用户
组
设备

用户

批量下载所有用户

# Import the Microsoft Graph module 
Import-Module Microsoft.Graph 

# Authenticate to Microsoft Graph (you may need to provide your credentials) 
Connect-MgGraph -Scopes "User.Read.All" 

# Get all users using Get-MgUser 
$users = Get-MgUser -All -ConsistencyLevel eventual -Property Id, DisplayName, UserPrincipalName,UserType,OnPremisesSyncEnabled,CompanyName,CreationType 

# Specify the output CSV file path 
$outputCsvPath = "C:\\Users\\YourUsername\\Documents\\Users.csv"  

# Create a custom object to store user data 
$userData = @() 

# Loop through each user and collect relevant data 
foreach ($user in $users) { 
    $userObject = [PSCustomObject]@{ 
        Id = $user.Id 
        DisplayName = $user.DisplayName 
        UserPrincipalName = $user.UserPrincipalName 
        UserType = $user.UserType 
        OnPremisesSyncEnabled = $user.OnPremisesSyncEnabled 
        CompanyName = $user.CompanyName 
        CreationType = $user.CreationType 
    } 
    $userData += $userObject 
} 

# Export user data to a CSV file 
$userData | Export-Csv -Path $outputCsvPath -NoTypeInformation 

# Disconnect from Microsoft Graph 
Disconnect-MgGraph 

Write-Host "User data exported to $outputCsvPath"

批量创建用户

# Import the Microsoft Graph module 
Import-Module Microsoft.Graph 

# Authenticate to Microsoft Graph (you may need to provide your credentials) 
Connect-MgGraph -Scopes "User.ReadWrite.All" 

# Specify the path to the CSV file containing user data 
$csvFilePath = "C:\\Path\\To\\Your\\Users.csv" 

# Read the CSV file (adjust the column names as needed) 
$usersData = Import-Csv -Path $csvFilePath 

# Loop through each row in the CSV and create users \
foreach ($userRow in $usersData) { 
    $userParams = @{ 
        DisplayName = $userRow.'Name [displayName] Required' 
        UserPrincipalName = $userRow.'User name [userPrincipalName] Required' 
        PasswordProfile = @{ 
            Password = $userRow.'Initial password [passwordProfile] Required' 
        } 
        AccountEnabled = $true 
        MailNickName = $userRow.mailNickName 
    } 
    try { 
        New-MgUser @userParams 
        Write-Host "User $($userRow.UserPrincipalName) created successfully." 
    } catch { 
        Write-Host "Error creating user $($userRow.UserPrincipalName): $($_.Exception.Message)" 
    } 
} 

# Disconnect from Microsoft Graph 
Disconnect-MgGraph 

Write-Host "Bulk user creation completed."

注意

请确保 CSV 文件包含必要的列（例如 DisplayName、UserPrincipalName 等）。此外，请调整脚本以匹配 CSV 文件中的实际列名。

批量删除用户

# Import the Microsoft Graph module 
Import-Module Microsoft.Graph 

# Authenticate to Microsoft Graph (you may need to provide your credentials) 
Connect-MgGraph -Scopes "User.ReadWrite.All" 

# Specify the path to the CSV file containing user data 
$csvFilePath = "C:\\Path\\To\\Your\\Users.csv" 

# Read the CSV file (adjust the column names as needed) 
$usersData = Import-Csv -Path $csvFilePath 

# Loop through each row in the CSV and delete users 
foreach ($userRow in $usersData) { 
    try { 
        Remove-MgUser -UserId $userRow.UserPrincipalName -Confirm:$false 
        Write-Host "User $($userRow.UserPrincipalName) deleted successfully." 
    } catch { 
        Write-Host "Error deleting user $($userRow.UserPrincipalName): $($_.Exception.Message)" 
    } 
} 

# Disconnect from Microsoft Graph 
Disconnect-MgGraph 

Write-Host "Bulk user deletion completed."

注意

请确保 CSV 文件包含必要的列（例如 UserPrincipalName）。此外，请调整脚本以匹配 CSV 文件中的实际列名。

Groups

批量下载所有组

Import-Module Microsoft.Graph.Groups 

 # Authenticate to Microsoft Graph (you may need to provide your credentials) 
 Connect-MgGraph -Scopes "Group.Read.All" 

 # Get the group members 
 $groups = Get-MgGroup -All | Select displayName, Id, groupTypes,mail 

 # Create a custom object to store group data 
$groupData = @() 

# Loop through each group and collect relevant data 
foreach ($group in $groups) { 
    if ($group.groupTypes -contains "Unified"){$groupType = "Microsoft 365"} 
    else {$groupType = "Security"} 
    if ($group.groupTypes -contains "DynamicMembership"){$membershipType = "Dynamic"} 
    else {$membershipType = "Assigned"} 
    $groupObject = [PSCustomObject]@{ 
        Id = $group.Id 
        DisplayName = $group.displayName 
        Mail = $group.mail 
        GroupType = $groupType 
        MemebershipType = $membershipType 
    }   
    $groupData += $groupObject 
} 

 # Specify the output CSV file path 
 $outputCsvPath = "C:\\Users\\cewu\\Documents\\Groups.csv" 

 $groupData| Export-Csv -Path $outputCsvPath -NoTypeInformation 
 
 Write-Host "Group members exported to $outputCsvPath"

批量下载组成员

Import-Module Microsoft.Graph.Groups 

 # Authenticate to Microsoft Graph (you may need to provide your credentials) 
 Connect-MgGraph -Scopes "Group.Read.All,GroupMember.Read.All" 

 # Set the group ID of the group whose members you want to download 
 $groupId = "your_group_id" 

 # Get the group members 
 $members = Get-MgGroupMember -GroupId $groupId -All | select * -ExpandProperty additionalProperties | Select-Object @( 
                'id'     
                @{  Name       = 'userPrincipalName' 
                    Expression = { $_.AdditionalProperties["userPrincipalName"] } 
                } 
                @{  Name = 'displayName' 
                Expression = { $_.AdditionalProperties["displayName"] } 
                } 
            ) 

 # Specify the output CSV file path 
 $outputCsvPath = "C:\\Users\\YourUserName\\Documents\\GroupMembers.csv" 

 $members| Export-Csv -Path $outputCsvPath -NoTypeInformation 

# Disconnect from Microsoft Graph 
Disconnect-MgGraph 

 Write-Host "Group members exported to $outputCsvPath"

批量添加成员

Import-Module Microsoft.Graph.Groups 

 # Authenticate to Microsoft Graph (you may need to provide your credentials) 
 Connect-MgGraph -Scopes "GroupMember.ReadWrite.All" 

# Import the CSV file 
$members = Import-Csv -Path "C:\path\to\your\file.csv" 

# Define the Group ID 
$groupId = "your-group-id" 

# Iterate over each member and add them to the group 
foreach ($member in $members) { 
    try{ 
        New-MgGroupMember -GroupId $groupId -DirectoryObjectId $member.memberObjectId 
  	 Write-Host "Added $($member.memberObjectId) to the group."  
    } 
    Catch{ 
        Write-Host "Error adding member $($member.memberObjectId):$($_.Exception.Message)" 
    } 
} 

# Disconnect from Microsoft Graph 
Disconnect-MgGraph

批量删除成员

Import-Module Microsoft.Graph.Groups 

 # Authenticate to Microsoft Graph (you may need to provide your credentials) 
 Connect-MgGraph -Scopes "GroupMember.ReadWrite.All" 

# Import the CSV file 
$members = Import-Csv -Path "C:\path\to\your\file.csv" 

# Define the Group ID 
$groupId = "your-group-id" 

# Iterate over each member and add them to the group 
foreach ($member in $members) { 
    try{ 
        Remove-MgGroupMemberByRef -GroupId $groupId -DirectoryObjectId $member.memberObjectId \
        Write-Host "Removed $($member.memberObjectId) from the group." 
    } 
    Catch{ 
        Write-Host "Error removing member $($member.memberObjectId):$($_.Exception.Message)" 
    } 
} 

# Disconnect from Microsoft Graph 
Disconnect-MgGraph

设备

批量下载所有设备

Import-Module Microsoft.Graph 

 # Authenticate to Microsoft Graph (you may need to provide your credentials) 
 Connect-MgGraph -Scopes "Device.Read.All" 

 # Get all devices  
 $devices = Get-MgDevice -All |select displayName,deviceId,operatingSystem,operatingSystemVersion,isManaged,isCompliant,mdmAppId,registeredOwners,TrustType 

 # Specify the output CSV file path 
 $outputCsvPath = "C:\\Users\\YourUserName\\Documents\\Devices.csv" 

 $devices| Export-Csv -Path $outputCsvPath -NoTypeInformation 

 Write-Host "Devices exported to $outputCsvPath"

通过