Reporting on Azure & AD on-prem groups

[Spudgun79]

Hi all,

Can someone please tell me the most straightforward way to report on groups/group membership of AD groups. We have a hybrid Azure / AD on-prem environment. So I would assume varying ways in which to accomplish this. 

Another more important question is the level of permissions / M365 role that we'd need to give someone to run these reports (power user non member of IT)

thanks!

[v-xiaoyan-msft · Accepted solution]

Hi @Spudgun79 ,

You can use the Exchange Online PowerShell module to easily collect Office 365 Group information, and then after getting the list of groups in your tenant, interrogate each group to retrieve membership and owner lists. 

For details,you can refer to:

Exporting Office 365 Group membership to a CSV file 

Active Directory – How to Generate a Group Membership Report 

The access you need  is Read-Access to Active Directory.

Also,Microsoft 365 or Office 365 subscription comes with a set of admin roles that you can assign to users in your organization using the Microsoft 365 admin center. Each admin role maps to common business functions and gives people in your organization permissions to do specific tasks in the admin centers.

You can assign the groups admin role to users who need to manage all groups settings across admin centers, including the Microsoft 365 admin center and Azure Active Directory portal.

Groups admins can:
- Create, edit, delete, and restore Microsoft 365 groups
- Create and update group creation, expiration, and naming policies
- Create, edit, delete, and restore Azure Active Directory security groups

For more details about admin roles in M365, you can refer to:Commonly used Microsoft 365 admin center roles 

Hope it helps,

Community Support Team _ Caitlyn

If this post helps then please consider Accept it as the solution to help the other members find it more quickly.

[GilbertQ]

Hi @Spudgun79 

Ideally you should have your On-Prem AD synching with Azure AD, that will then allow all the groups to be available?

For users to view the reports they just need to have the permissions granted, which you can use by typing in their email address?