Azure Active Directory (Azure AD) plays a critical role in managing identities and access in modern IT environments. As an administrator, you may often need to export a list of security groups and their members for reporting or auditing purposes. This explains how to use a PowerShell script to accomplish this efficiently.

---

What Does the Script Do?

This PowerShell script performs the following tasks:

1. Connects to Azure AD.
2. Retrieves all security-enabled groups.
3. Extracts each group’s members, including their display names and user principal names.
4. Exports the details to a CSV file for easy reference.

---

Prerequisites

Before running this script, ensure you have the following:

1. Azure AD PowerShell Module: The script uses the AzureAD module. Install it by running:
   Install-Module AzureAD
2. Permissions: You need appropriate permissions to access Azure AD groups and their members.
3. PowerShell: The script should be run in an elevated PowerShell session.

---

Script Breakdown

Here’s a detailed explanation of each section of the script:

1. Install and Connect to Azure AD

The script starts by importing the AzureAD module and connecting to Azure AD:

Install-Module AzureAD 
Connect-AzureAD

You will be prompted to authenticate. Use credentials with the necessary permissions.

---

2. Define the Output File

The script defines the location of the output CSV file where the results will be saved:

$outputFile = "C:\Temp\SecurityGroupsAndMembers.csv"
"GroupName,MemberDisplayName,MemberUserPrincipalName" | Out-File -FilePath $outputFile

• The Out-File command writes the CSV header row to the file.

---

3. Retrieve and Process Security Groups

The script retrieves all security-enabled groups:

$Groups = Get-AzureADGroup | Where-Object { $_.SecurityEnabled -eq $true }

• The Where-Object filter ensures only security-enabled groups are processed.

For each group, it extracts the group name and ID, then fetches the members using:

$Members = Get-AzureADGroupMember -ObjectId $GroupId

---

4. Export Group and Member Details

The details of each member are written to the CSV file in the following format:

"$GroupName,$MemberDisplayName,$MemberUserPrincipalName" | Out-File -FilePath $outputFile -Append

• The -Append parameter ensures that new data is added to the existing file without overwriting it.

---

5. Disconnect from Azure AD

Once the processing is complete, the script disconnects from Azure AD:

Disconnect-AzureAD

---

Full Script

Here’s the full script for easy reference:

Install-Module AzureAD 

# Connect to Azure AD
Connect-AzureAD

# Define the output file
$outputFile = "C:\Temp\SecurityGroupsAndMembers.csv"
"GroupName,MemberDisplayName,MemberUserPrincipalName" | Out-File -FilePath $outputFile

# Get all Security Groups
$Groups = Get-AzureADGroup | Where-Object { $_.SecurityEnabled -eq $true }

# Loop through each group
foreach ($Group in $Groups) {
    $GroupName = $Group.DisplayName
    $GroupId = $Group.ObjectId
    
    Write-Host "Processing group: $GroupName"
    
    # Get members of the group
    $Members = Get-AzureADGroupMember -ObjectId $GroupId
    
    # Loop through members and export details
    foreach ($Member in $Members) {
        $MemberDisplayName = $Member.DisplayName
        $MemberUserPrincipalName = $Member.UserPrincipalName

        # Append group and member details to CSV
        "$GroupName,$MemberDisplayName,$MemberUserPrincipalName" | Out-File -FilePath $outputFile -Append
    }
}

Write-Host "Export completed! File saved to $outputFile"

# Disconnect from Azure AD
Disconnect-AzureAD

---

Key Considerations

1. Output File Path: Ensure the directory C:\Temp exists or modify the path in $outputFile to a valid location.
2. Large Group Handling: For environments with many groups or members, consider adding error handling and optimizing performance.
3. Data Security: The CSV file contains sensitive data. Secure it appropriately after generation.

This PowerShell script simplifies the process of exporting Azure AD security groups and their members to a CSV file. With minimal setup, you can generate detailed reports for analysis, auditing, or compliance purposes. Customize the script as needed to suit your specific requirements.