Export Microsoft 365 Administrative Units to CSV with PowerShell

Managing Administrative Units (AUs) in Microsoft 365 can be tricky—especially when you need to audit role assignments, verify scoping rules, or prepare for compliance checks. The AU list in the Microsoft 365 admin portal doesn’t always give you the full picture in a format you can easily work with.

This script solves that problem by exporting every AU in your tenant—including its unique Id, display name, and description—to a CSV file. Having AU IDs at hand makes it much easier to:

• Match AUs against role assignments or automation scripts
• Build scoping rules for Conditional Access or Intune policies
• Maintain an up-to-date AU inventory for security audits and governance reviews
• Quickly share AU details with your team or external auditors in a clean, filterable format

It’s simple, fast, and requires no advanced scripting—just connect, fetch, and export.

The Script

# Connect to Microsoft Graph (run once per session)
Connect-MgGraph -Scopes "AdministrativeUnit.Read.All","Directory.Read.All"
# Choose your output path (timestamped by default)
$OutputPath = ".\AdministrativeUnits_{0}.csv" -f (Get-Date -Format "yyyyMMdd_HHmmss")
                                
# Fetch all AUs with selected properties
$aus = Get-MgDirectoryAdministrativeUnit -All -Property Id,DisplayName,Description
                                
# Handle empty results gracefully
if (-not $aus) {
    Write-Warning "No Administrative Units were found in the tenant."
    $aus = @()
}
                                
# Export to CSV (UTF-8)
$aus |
Select-Object Id, DisplayName, Description |
Export-Csv -Path $OutputPath -NoTypeInformation -Encoding UTF8
                                
Write-Host "Export complete: $OutputPath"

How the Script Works

1. Connects to Graph using AdministrativeUnit.Read.All (and Directory.Read.All) and locks to the stable v1.0 profile.
2. Builds an output file name with a timestamp to avoid overwriting previous runs.
3. Retrieves all AUs using Get-MgDirectoryAdministrativeUnit -All and requests only the properties you need (Id, DisplayName, Description) for speed and clarity.
4. Exports results to CSV in UTF-8 encoding so it opens cleanly in Excel/Power BI.

Further Enhancing the Script

• Add filters

Narrow by name:

Get-MgDirectoryAdministrativeUnit -Filter "startswith(displayName,'EMEA')" -ConsistencyLevel eventual

• Search by keyword

Broad matching across indexed fields:

Get-MgDirectoryAdministrativeUnit -Search '"marketing"' -ConsistencyLevel eventual

• Select more properties

Add columns like Description, Visibility, etc.:

-Property Id,DisplayName,Description

• Change output location

Point to a reports folder:

$OutputPath = "D:\Reports\AdministrativeUnits_{0}.csv" -f (Get-Date -Format "yyyyMMdd_HHmmss")

Possible Errors & Solutions

Error	Cause	Solution
Authorization_RequestDenied / Insufficient privileges	Missing Graph permission/consent.	Connect with AdministrativeUnit.Read.All (or Directory.Read.All), accept consent, and re-run Connect-MgGraph.
Request_UnsupportedQuery (with -Filter/-Search)	Unsupported property or malformed OData.	Use filterable props (e.g., displayName), keep filters simple (eq, startswith), or switch to -Search '"term"' with -ConsistencyLevel eventual.
ResourceNotFound / 404 (when fetching a specific AU elsewhere)	Wrong AU Id or deleted AU.	List all AUs first and copy the correct Id.
Partial results / paging issues	Not enumerating all pages.	Always include -All to auto-page through results.
Empty CSV	No AUs match the query / tenant has none.	Remove filters or validate AU presence in the tenant.

Conclusion

This minimalist script is ideal for quick inventories and baseline reporting of Administrative Units. The exported AU IDs are particularly useful for auditing, policy scoping, and automation scripting—areas where admin portals often fall short. It’s fast, readable, and easy to adapt—add filters, include more properties, or redirect the output path as needed.