microsoftgraph / microsoftgraph/msgraph-sdk-powershell

Get-MgGroupMember doesn't return service principals as group members

Open
#2,853 6 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Status: Needs Investigation
Dominant language
C#
Stars
898
Forks
230
Avg merge
2d 5h
Merged PRs (30d)
31

Description

Describe the bug

I was trying to list all members (users, nested groups, devices, service principals) of certain Entra ID groups, using Get-MgGroupMember cmdlet. I found that in a list of groups I was interested in I found only one user, but in fact there was a user and service principal.

I checked another group that has SPs as group members only and Get-MgGroupMember showed that it is empty.

Expected behavior

According to the cmdlet synopsis, Get-MgGroupMember should do following:

Get a list of the group's direct members.
A group can have users, organizational contacts, devices, service principals and other groups as members.

But in fact it doesn't display SPs.

How to reproduce
  1. Create an Entra ID group with a service principal member.
  2. Execute Get-MgGroupMember -GroupId $GroupId.
  3. Observe missing SP id in the output.
SDK Version

2.20.0

Latest version known to work for scenario above?

No response

Known Workarounds

No response

Debug output
Click to expand log ```
</details>


### Configuration

- OS: Windows 11
- OS Build: 22H2 22621.3737
- Arch: x64
- PSVersion: 5.1.22621.3672

### Other information

_No response_

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the Get-MgGroupMember cmdlet and reproduce the issue using an Entra ID group containing a service principal, as described in the three-step report. Compare the command output with the group's actual direct members. Done means service principal IDs appear alongside users, nested groups, and devices without omitting them.

Written by the indexing model from the issue text.

Assessment

Tech stack
powershell
Domain
api
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.