How to Use Get-MgGroupOwner to Fetch Group Owners

What is Get-MgGroupOwner?

The Get-MgGroupOwner cmdlet is part of the Microsoft Graph PowerShell module, designed to retrieve the owners of a specified Microsoft 365 group. Group owners have administrative privileges over the group, including managing memberships and settings.

Why Use Get-MgGroupOwner?

Managing Microsoft 365 groups efficiently requires visibility into their ownership. Administrators can use Get-MgGroupOwner to:

• Audit and verify group ownership for compliance.
• Identify missing or incorrect owners for critical groups.
• Automate group management by integrating ownership details into scripts.

Cmdlet Syntax

Get-MgGroupOwner -GroupId  [-All]  [-Filter <String>] [-Search <String>] 

Key Parameters:

• -GroupId (Mandatory): Specifies the ID of the Microsoft 365 group.
• -All: Retrieves all owners of the specified group.
• -Filter: Enables filtering results based on conditions.
• -Search: Performs a search operation within group owners.

Usage Examples

1. Passing Group ID Directly

Get-MgGroupOwner -GroupId "1e141d1d-71c0-4f24-8ed2-2ce3a63c28d5"

This command retrieves all owners of the specified group.

2. Passing Group ID When Prompted by Console

Get-MgGroupOwner

If no -GroupId parameter is provided, the console may prompt the user to enter a valid group ID interactively.

3. Fetch Additional User Information

The following script retrieves detailed user information for each group owner:

# Retrieve owners of the specified group  
$groupOwners = Get-MgGroupOwner -GroupId "1e141d1d-71c0-4f24-8ed2-2ce3a63c28d5"  
                                                
# Initialize an array to store detailed user information  
$userDetails = @()  
                                                
# Loop through each group owner and retrieve additional properties  
foreach ($member in $groupOwners) {  
    $user = Get-MgUser -UserId $member.Id -Property "id, displayName, userPrincipalName"  
    $userDetails += [PSCustomObject]@{  
    Id                 = $user.Id  
    DisplayName        = $user.DisplayName  
    UserPrincipalName  = $user.UserPrincipalName  
}  
}  
                                                
# Display the detailed user information  
$userDetails | Select-Object Id, DisplayName, UserPrincipalName
                                            

This script enhances the basic Get-MgGroupOwner output by pulling additional user properties using the Get-MgUser cmdlet.

Frequently Asked Questions

Can I retrieve owners for multiple groups at once?

No, Get-MgGroupOwner works on a single group at a time. To retrieve multiple groups, loop through their IDs.

Does this cmdlet return only users, or does it include other objects?

It returns all owners, including users and service principals if they are assigned as group owners.

How can I check if a specific user is an owner of a group?

Use Get-MgGroupOwner with Where-Object to filter results based on user ID or email.

Use Cases

1. Auditing Group Ownership: Ensure compliance by verifying correct owners for critical groups.
2. Automated Group Management: Integrate ownership details into PowerShell scripts for automated administration.
3. Troubleshooting Access Issues: Verify if a user has ownership permissions in a group.

Conclusion

The Get-MgGroupOwner cmdlet is essential for managing Microsoft 365 groups effectively. By fetching group owners and their details, administrators can streamline group management, ensure compliance, and automate administrative tasks. Whether used for audits, troubleshooting, or automation, this cmdlet plays a crucial role in maintaining a well-managed Microsoft 365 environment.