Comments on: Reporting Office 365 Admin Role Group Members

By: Natalie Frith

Natalie Frith — Tue, 02 Feb 2021 14:16:25 +0000

Comments for this blog post are now closed; please contact team@practical365.com for any additional questions and comments, thank you.

By: Zaur

Zaur — Sat, 06 Jun 2020 10:05:32 +0000

Please tell me why I get such an error?

Get-O365AdminGroupsReport (1).ps1
D:\Users\Admin\Downloads\Get-O365AdminGroupsReport (1).ps1:67 знак:1
+ [CmdletBinding()]
+ ~~~~~~~~~~~~~~~~~
Непредвиденный атрибут “CmdletBinding”.
D:\Users\Admin\Downloads\Get-O365AdminGroupsReport (1).ps1:68 знак:1
+ param (
+ ~~~~~
Непредвиденная лексема “param” в выражении или операторе.
+ CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : UnexpectedAttribute

By: Joe S.

Joe S. — Wed, 22 Apr 2020 03:40:57 +0000

This command works fine for me.
Get-AzureADDirectoryRoleTemplate

This command errors out.
Get-AzureADDirectoryRoleMember -ObjectId 966707d0-3269-4727-9be2-8c3a10f19b9d
GetMessage: Resource ‘966707d0-3269-4727-9be2-8c3a10f19b9d’ does not exist or one of its queried reference-property
objects are not present.
RequestId: 5a8e0ba2-03df-4319-a0fc-74e8e6a5dd50-AzureADDirectoryRoleMember -ObjectId 966707d0-3269-4727-9be2-8c3a10f19b9d

Why do you think that is? I’ve already run Install-Module -name azuread and it tells me I have many AAD commands available.

By: T A

T A — Wed, 12 Feb 2020 16:21:37 +0000

Hi Paul!
Yet another awesome contribution of yours 🙂 🙂 :).

I came across this while searching for a way to get members of all Exchange RoleGroups with members in a report.

I ran Get-RoleGroup “Role1” | fl

to look at all the objects returned.
Then I started wondering if I could just replace the values I am interested in within your script.
Of course also changing
$AzureADRoles = @(Get-AzureADDirectoryRole -ErrorAction Stop)

to
$Roles = @(Get-RoleGroup -ErrorAction Stop)

Do you already have a script to report on Exchange RoleGroup members?

By: Chris

Chris — Thu, 18 Apr 2019 03:26:07 +0000

Great script, but is there a way to report on which Admins have actively used Roles over the last 30 days? That way you can get an idea on who has too many Roles assigned and cut them back.

By: Oscar

Oscar — Thu, 04 Apr 2019 06:52:21 +0000

In reply to Wolfgang Bach.

$Check = Get-MsolUser -UserPrincipalName $upn | ? {$_.StrongAuthenticationRequirements -like “*”}

If ($Check -ne $null)
{
$MFA = “ON”
}
else
{
$MFA = “OFF”
}
}

By: Wolfgang Bach

Wolfgang Bach — Thu, 14 Jun 2018 09:35:39 +0000

Hi, could you please include if MFA is enabled for Admin Accounts?
Best regards

By: Niles

Niles — Fri, 18 May 2018 09:50:25 +0000

How about Intune Roles?

By: David

David — Mon, 22 Jan 2018 17:12:33 +0000

There are some issues with this script. It fails to check for the AzureAD module correctly on a fully patched Win10 Pro, even when run in a PS “as administrator” (and I am a local computer admin). I triple verified I had the AzureAD PowerShell module (it is version 1.1.166.0) so I had to disable this check in the script (I can run some commands manually, also proving I have the module and it is working). Next when the script calls for credentials upon running “Connect-AzureAD -ErrorAction Stop” it defaults to a web pop-up version of the credentials gathering which redirects after I enter my username due to ADFS and fails to auth, but I know the ADFS works for login.microsoftonline.com (tested a login and it works, no password typos). So to further edit I added “$cred = Get-Credential” above that line in the script (which then provides the regular windows pop-up style credentials gathering) then edited the call to “Connect-AzureAD -Credential $cred -ErrorAction Stop”. Now the script runs and I get the CSV. By that, it’s clear to me I have the modules required making the first error a boggle.

By: Paul Cunningham

Paul Cunningham — Wed, 13 Dec 2017 01:02:30 +0000

In reply to Jay Fox. Connect-MsolService is not a cmdlet in the AzureAD module. Are you sure you have the correct module installed?