How to find group membership changes in Microsoft Entra ID

Before you start

Use an account in the Reports Reader, Security Reader or Security Administrator role. The PowerShell example requests AuditLog.Read.All; your organisation may require administrator consent. The audit log is in every edition of Microsoft Entra ID; only how long it is kept differs.

Know what is logged. These 2 activities record each member added to or removed from a group in Entra ID, whether a person or an app made the change. Owner changes and PIM changes to a group's eligible members are logged under other activities. Times are in UTC. The examples read and export; they don't change any group.

Option 1

Find group membership changes with PowerShell

Install the modules once, then connect and export the last 7 days of additions and removals, newest first. The date and activity filter runs in Microsoft Graph, so only those entries come back.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Reports -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'AuditLog.Read.All' -NoWelcome
try {
    $days = 7
    $since = (Get-Date).ToUniversalTime().AddDays(-$days).ToString('yyyy-MM-ddTHH:mm:ssZ')
    $activities = 'Add member to group', 'Remove member from group'
    $entries = @(foreach ($activity in $activities) {
        $filter = "activityDateTime ge $since and activityDisplayName eq '$activity'"
        Get-MgAuditLogDirectoryAudit -All -Filter $filter
    })
    $report = @($entries | Sort-Object ActivityDateTime -Descending | ForEach-Object {
        $targets = @($_.TargetResources)
        $groups = $targets | Where-Object { $_.Type -eq 'Group' }
        $members = $targets | Where-Object { $_.Type -ne 'Group' } | ForEach-Object {
            if ($_.UserPrincipalName) { $_.UserPrincipalName } else { $_.DisplayName }
        }
        $by = $_.InitiatedBy.User.UserPrincipalName
        if (-not $by) { $by = $_.InitiatedBy.App.DisplayName }
        [pscustomobject]@{
            When     = $_.ActivityDateTime
            Activity = $_.ActivityDisplayName
            Group    = @($groups.DisplayName) -join '; '
            Member   = @($members) -join '; '
            By       = $by
            Result   = $_.Result
        }
    })
    if ($report.Count -eq 0) {
        Write-Output "No group membership changes in the last $days days."
    } else {
        $path = './group-membership-changes.csv'
        $report | Export-Csv -Path $path -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) group membership changes in the last $days days."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

By is the person who made the change, or the app when no person did. Member is the user or device added or removed; when a group is added to another group, both show under Group. Raise $days to 30, the most the log keeps with P1 or P2. To keep a longer record, run the script on a schedule and keep each CSV.

Narrow it to 1 group

Run this in the same window after the export, while $report still holds the changes.

# Replace the example group name.
$report | Where-Object { $_.Group -eq 'Contoso Sales' } |
    Format-Table When, Activity, Member, By

Option 2

Find group membership changes in the admin centre

1. Sign in to the Microsoft Entra admin centre for the correct tenant as at least a Reports Reader.
2. Go to Entra ID > Monitoring & health > Audit logs.
3. Set the Date range, then filter Category to GroupManagement and Activity to Add member to group or Remove member from group.
4. To find 1 group or person, use Target with the first letters of the name. The search is case-sensitive.
5. Select an entry for its details, including who made the change and the targets, or select Download to save the filtered list.

This suits answering who changed 1 group this week. For a record you can keep, use PowerShell or a report.

Common questions

How do I keep the changes for longer than 30 days?

Microsoft Purview's audit log keeps Entra ID activity for 180 days with Audit (Standard), on Microsoft 365 licences other than E5, and 1 year with E5. Otherwise, send the log to an Azure storage account through Azure Monitor, or keep each export.

Which groups matter most?

Groups that hold an admin role: adding someone to one gives them the role. Microsoft points to these same 2 activities for auditing them. To list who is in them now, see how to list privileged group members.

Why does the audit log show no results?

When the service is busy, a query can be throttled and come back empty, whatever the size of the tenant. Break it into shorter date ranges until results return.