KBY Technologies Logo
Microsoft Entra ID · PowerShell 7.6

Groups with no owner

Which Microsoft 365 groups, security groups and distribution groups in Entra ID have no owner, so nobody outside IT can manage their membership or answer an access review?

Script

#Requires -Modules Microsoft.Graph.Authentication, Microsoft.Graph.Groups
# Entra ID groups that have no owner. Read-only.
param(
    [switch]$IncludeSyncedGroups
)

Connect-MgGraph -Scopes 'GroupMember.Read.All' -NoWelcome

Get-MgGroup -All -Property 'id', 'displayName', 'groupTypes', 'mailEnabled', 'securityEnabled', 'onPremisesSyncEnabled', 'createdDateTime' |
    Where-Object { $IncludeSyncedGroups -or -not $_.OnPremisesSyncEnabled } |
    ForEach-Object {
        $owner = Get-MgGroupOwner -GroupId $_.Id -Top 1
        if (-not $owner) {
            $groupType = if ($_.GroupTypes -contains 'Unified') { 'Microsoft 365' }
                elseif ($_.MailEnabled -and $_.SecurityEnabled) { 'Mail-enabled security' }
                elseif ($_.SecurityEnabled) { 'Security' }
                else { 'Distribution' }
            [pscustomobject]@{
                DisplayName     = $_.DisplayName
                GroupType       = $groupType
                Membership      = if ($_.GroupTypes -contains 'DynamicMembership') { 'Dynamic' } else { 'Assigned' }
                SyncedFromAD    = $_.OnPremisesSyncEnabled -eq $true
                CreatedDateTime = $_.CreatedDateTime
                Id              = $_.Id
            }
        }
    } |
    Sort-Object GroupType, DisplayName

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

  • GroupMember.Read.All is the least privileged permission for listing owners, and it also covers listing groups.
  • Groups synced from on-premises Active Directory are skipped unless you pass -IncludeSyncedGroups, because their membership is managed in AD.
  • Makes one owners request per group, so it takes a while in tenants with many thousands of groups.
  • GroupType follows Microsoft's table: groupTypes containing Unified is Microsoft 365; otherwise mailEnabled and securityEnabled decide Security, Mail-enabled security or Distribution. Membership is Dynamic when groupTypes contains DynamicMembership.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.

Connect-MgGraph (Microsoft.Graph.Authentication)Get-MgGroup (Microsoft.Graph.Groups)Get-MgGroupOwner (Microsoft.Graph.Groups)List group owners: permissions and supported rolesList groups: permissionsWorking with groups in Microsoft Graph: group typesgroup resource type: groupTypes and DynamicMembershipWhere-Object (Microsoft.PowerShell.Core)ForEach-Object (Microsoft.PowerShell.Core)Sort-Object (Microsoft.PowerShell.Utility)
All scripts