Microsoft Entra ID security

How to list privileged group members in Microsoft Entra ID

List the members of role-assignable groups with Microsoft Graph PowerShell, check a group in the Entra admin centre, or use Altivane's Directory Roles and PIM report.

By the Altivane Team Published 7 November 2026

To list privileged group members in Microsoft Entra ID, find the role-assignable groups, read the roles each one holds, then list each group's members. A role held through a group reaches every member, while the role lists show only the group. Members who can activate their membership through Privileged Identity Management (PIM) are listed separately, and PIM needs Microsoft Entra ID P2 or Microsoft Entra ID Governance.

Choose the method that fits the job
Method	Best fit
PowerShell	A CSV of every member of every role-assignable group, with the roles the group holds.
Admin centre	Checking 1 role's groups, or 1 group's members and eligible assignments.
Altivane	Recommended for recurring reviews, with standing, active and eligible membership in 1 table.

Before you start

Use an account in the Global Reader or Privileged Role Administrator role. Role-assignable groups need Microsoft Entra ID P1. The main example requests Group.Read.All, User.Read.All and RoleManagement.Read.Directory, and the PIM example PrivilegedEligibilitySchedule.Read.AzureADGroup; your organisation may require administrator consent.

Know what the list covers. Only a role-assignable group can be given a Microsoft Entra role, and it can't have other groups as members, so its direct members are everyone it reaches. The examples read and export; they don't change any group or role.

Option 1

List privileged group members with PowerShell

Install the modules once, then connect and export each member of each role-assignable group with the roles the group holds.

# Install once, if the modules are not already installed.
$modules = 'Microsoft.Graph.Authentication', 'Microsoft.Graph.Groups',
    'Microsoft.Graph.Identity.Governance'
Install-Module $modules -Scope CurrentUser

$ErrorActionPreference = 'Stop'
$scopes = 'Group.Read.All', 'User.Read.All', 'RoleManagement.Read.Directory'
Connect-MgGraph -Scopes $scopes -NoWelcome
try {
    $roles = @{}
    Get-MgRoleManagementDirectoryRoleDefinition -All |
        ForEach-Object { $roles[$_.Id] = $_.DisplayName }
    $groups = @(Get-MgGroup -All -Filter 'isAssignableToRole eq true' | Sort-Object DisplayName)
    $properties = 'displayName', 'userPrincipalName', 'accountEnabled'
    $report = @(foreach ($group in $groups) {
        $filter = "principalId eq '$($group.Id)'"
        $held = @(Get-MgRoleManagementDirectoryRoleAssignment -All -Filter $filter |
            ForEach-Object { $roles[$_.RoleDefinitionId] }) -join '; '
        $members = Get-MgGroupMemberAsUser -GroupId $group.Id -All -Property $properties
        foreach ($member in $members) {
            [pscustomobject]@{
                Group             = $group.DisplayName
                RolesHeld         = $held
                Member            = $member.DisplayName
                UserPrincipalName = $member.UserPrincipalName
                Enabled           = $member.AccountEnabled
            }
        }
    })
    if ($report.Count -eq 0) {
        Write-Output "No members found in $($groups.Count) role-assignable groups."
    } else {
        $path = './privileged-group-members.csv'
        $report | Export-Csv -Path $path -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) memberships in $($groups.Count) groups exported."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

RolesHeld lists the roles assigned to the group as active assignments. A group that is only eligible for a role through PIM shows it blank, and a group with no members has no row. A disabled member still sits in the group, so Enabled shows who could sign in today.

Add members eligible through PIM

Eligible members have their own cmdlet and permission. Run this on its own; it needs PIM in the tenant.

$ErrorActionPreference = 'Stop'
$scopes = 'Group.Read.All', 'PrivilegedEligibilitySchedule.Read.AzureADGroup'
Connect-MgGraph -Scopes $scopes -NoWelcome
try {
    $groups = @(Get-MgGroup -All -Filter 'isAssignableToRole eq true')
    $report = @(foreach ($group in $groups) {
        $filter = "groupId eq '$($group.Id)'"
        $eligible = Get-MgIdentityGovernancePrivilegedAccessGroupEligibilityScheduleInstance `
            -All -Filter $filter -ExpandProperty principal
        foreach ($entry in $eligible) {
            [pscustomobject]@{
                Group     = $group.DisplayName
                Principal = $entry.Principal.AdditionalProperties['displayName']
                Access    = $entry.AccessId
                Ends      = $entry.EndDateTime
            }
        }
    })
    if ($report.Count -eq 0) {
        Write-Output 'No eligible members or owners were found.'
    } else {
        $path = './eligible-group-members.csv'
        $report | Export-Csv -Path $path -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) eligible assignments exported."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

Access is member or owner, and a blank Ends means the eligibility doesn't expire.

Option 2

Check privileged groups in the admin centre

Sign in to the Microsoft Entra admin centre for the correct tenant.
Go to Entra ID > Roles & admins, select a role, then Assignments. A holder that is a group gives the role to its members.
Go to Entra ID > Groups > All groups, select that group, then Members.
For eligible membership, go to ID Governance > Privileged Identity Management > Groups, select the group, then Assignments, and read Eligible assignments and Active assignments.

This suits checking 1 role or 1 group. Each group opens on its own, so for every privileged group with its members, use PowerShell or a report.

Option 3 · Recommended for recurring reviews

Report on privileged group members with Altivane

Open Altivane and choose the tenant.
Build the tenant's documents with the Directory Roles and PIM scorecard report in full, so people are listed as well as counted.
Open the tenant's Excel workbook and find Privileged Group Membership: each member of every group that holds a role or can be assigned one, with the roles the group holds, whether the account is enabled, how the person belongs (Member, PIM active or PIM eligible) and when that ends.
Read Role Assignment Summary for how many groups hold roles, and Privileged People for each person's roles from every path.

Altivane puts eligible and active PIM membership in the same table as standing membership, so a person who can activate into a role group isn't missed. Where a group's members or its PIM entries can't be read, the table says it was not collected rather than leaving people out. The build also writes the tenant's Word report.

Common questions

Why isn't a group that should hold a role on the list?

Only a group created as role-assignable can hold a role. The setting is fixed when the group is made, so an existing group can't be turned into one. Create a new role-assignable group and move the members to it.

Who can change a role-assignable group's members?

Privileged Role Administrators by default, and any owners you add. Changing the password or MFA of the group's members and owners needs at least Privileged Authentication Administrator, which stops a lesser administrator taking over a member.

How do I see the roles people hold directly?

Read the directory role assignments, where a person's own assignments sit beside the groups. See how to list admin role assignments.

Microsoft references

Technical references checked on 7 November 2026. The example scripts have been reviewed and syntax checked; they have not been run against a live tenant.