Using -Filter with Get-MgGroup Cmdlet

The Get-MgGroup cmdlet in Microsoft Graph PowerShell allows administrators to retrieve details of Microsoft 365 groups, security groups, and distribution lists. One of the most powerful features of this cmdlet is the -Filter parameter, which enables precise filtering based on group properties. This article explores how to use -Filter with Get-MgGroup and provides practical examples to streamline group management in Microsoft 365.

Get-MgGroup -Filter Examples

Below are some commonly used filter queries with Get-MgGroup:

Filter By Microsoft 365 Groups (Unified Groups)

Get-MgGroup -All -Filter "groupTypes/any(c:c eq 'Unified')"

Explanation:

• This retrieves only Microsoft 365 groups (Unified groups), excluding security groups and distribution lists.
• The groupTypes property contains "Unified" for M365 Groups.

Filter Only Security Enabled Groups

Get-MgGroup -All -Filter "securityEnabled eq true"

Explanation:

• This filters and retrieves only security-enabled groups, typically used for access control.
• Distribution groups and Microsoft 365 groups that are not security-enabled are excluded.

Filter Groups by Display Name

Get-MgGroup -All -Filter "displayName eq 'HR Department'"

Explanation:

• Retrieves a group that has the exact display name "HR Department".
• Modify "HR Department" to match the specific group name you are searching for.

Filter Only Dynamic Groups

Get-MgGroup -All -Filter "membershipRuleProcessingState eq 'On'"

Explanation:

• Retrieves all dynamic groups, where membership is managed automatically based on rules.
• The membershipRuleProcessingState property indicates whether the group is dynamic (On = Active).

Important Considerations

1. Exact Matches Required: The -Filter parameter requires exact property matches. For example, displayName eq 'HR Department' must match exactly; partial matches won't work.
2. Case Sensitivity: OData filters used in Graph PowerShell are case-insensitive but must be formatted correctly.
3. Date Formatting: When filtering by date, use UTC format (YYYY-MM-DDTHH:MM:SSZ). Example:
4. Get-MgGroup -All -Filter "createdDateTime ge 2024-01-01T00:00:00Z"
5. Advanced Queries Need Additional Parameters: If your query involves counting or complex conditions, use -ConsistencyLevel eventual and $count:
6. Get-MgGroup -All -Filter "securityEnabled eq true" -ConsistencyLevel eventual -CountVariable Records
7. Not All Properties are Filterable: Only a subset of properties support filtering. Check the Microsoft Graph API documentation for supported filters.

By using the -Filter parameter effectively, administrators can quickly retrieve relevant groups, making Microsoft 365 management more efficient. Mastering these filtering techniques will significantly enhance your automation capabilities in Graph PowerShell.