Azure AD

How to Get Nested Groups Report in Microsoft 365

Larger organizations require Microsoft 365 nested groups to represent sub-groups since they manage multiple departments & projects. Nested groups streamline permission management by granting access at a higher group level and offering flexibility for individual sub-groups. This guide will help you get Entra ID nested groups report in Microsoft 365, enabling you to manage them more efficiently.

Using PowerShell

Microsoft 365 Permission Required

Group Admin Least Privilege

Global Admin Most Privilege

Connect to Microsoft Graph PowerShell Module with 'GroupMember.Read.All' permission.

Windows PowerShell

 Connect-MgGraph -Scopes GroupMember.Read.All

Then, run the following cmdlet to get all nested groups within a specific group in Microsoft 365.

Windows PowerShell

 Get-MgGroupMemberAsGroup –GroupId <GroupId>

Using Powershell Script

Microsoft 365 Permission Required

Group Admin Least Privilege

Global Admin Most Privilege

Note that the above PowerShell cmdlet returns nested groups only for a specified group. However, it won't check each group or retrieve a complete list of nested groups across your organization.
To overcome this limitation, we have developed a user-friendly PowerShell script that retrieves all nested groups within your M365 tenant.
Download and run the script in Administrator PowerShell to export all nested groups in Microsoft 365.

M365NestedGroups.ps1

Using AdminDroid
Simple & Quick

AdminDroid Permission Required Delegated

Any user with report access delegated by the Super Admin.

Log in to the AdminDroid Office 365 portal.
Navigate to the Nested Groups report under Reports»Azure AD»Group Reports.

AdminDroid Azure AD Reporter

Finding all Microsoft 365 nested groups made easy!

The AdminDroid’s Azure AD reporting tool simplifies the process of retrieving all nested groups in your Microsoft 365 environment. It offers detailed reports on M365 groups, facilitating effective management and control over group-related activities in your organization.

Locate Nested Groups with Advanced Filtering in Ease

Enhance your ability to locate nested groups efficiently through AdminDroid rich filtering, allowing you to easily filter groups based on properties, such as group type, mail-enabled status, and more.

Stay Informed about Changes in Group Memberships

Gain insights into Microsoft 365 group activities with detailed audit reports. Track changes and stay informed about modifications in group memberships, making it easier to monitor your organization’s group activities.

Detailed Analysis of Microsoft 365 Groups

Access comprehensive insights on Microsoft 365 group reports that detail memberships, ownerships, and group types like security, distribution, and mail-enabled groups to enhance group management.

Get Regular Updates on Nested Groups in M365

Schedule the nested groups report to receive updates in your inbox daily, weekly, or monthly. This ensures you stay informed about nested groups and gain better insights into group memberships and configurations.

Easily Manage Empty Groups in Microsoft 365

The Empty Groups report lets you easily spot M365 groups without members. You can quickly decide whether to delete or retain these groups, helping you maintain a clutter-free and efficient M365 environment.

Simplified Dashboard for Efficient Group Management

The Microsoft 365 group dashboard gives you a centralized view of all group-related metrics and activities within Azure AD at a glance, that reduces the time spent navigating various interfaces.

Overall, AdminDroid helps you easily find nested groups, making the process quick and effortless with just a few clicks. AdminDroid’s Azure AD auditing tool allows you to monitor user permissions, license changes, group setting changes, and much more.

Explore a full range of reporting options

Download Live Demo

Important Tips

Since Microsoft 365 group-based licensing doesn't apply to members of nested groups, make sure that all users who require licenses are direct members of the licensed groups.

Use nested groups as includeTarget or excludeTarget in system-preferred MFA setting to enable the most-secured authentication methods for the nested group members.

As Microsoft Entra supports nested groups, you can create and add them for wider deployment while enabling the self-service password reset based on your organization needs.

Common Errors and Resolution Steps

The following are the possible errors and troubleshooting hints while accessing all nested groups in Azure AD.

Error Nesting is currently not supported for groups that can be assigned to a role.

This error occurs when attempting to nest a group that is assigned to a role in Microsoft Entra ID. Role-assignable groups do not support nesting, which leads to the error.

Fix Use the below PowerShell cmdlet to identify role-assignable groups and ensure the group you're trying to nest is not one of them.

Get-MgGroup -Filter "isAssignableToRole eq true"

Error Get-MgGroupMemberAsGroup : Insufficient privileges to complete the operation.

This error occurs when running the 'Get-MgGroupMemberAsGroup' cmdlet without necessary permissions to perform the requested operation.

Fix Use the 'GroupMember.Read.All' permission to connect MS Graph PowerShell module before running the 'Get-MgGroupMemberAsGroup' cmdlet.

// # Run the below cmdlet to connect MS Graph PowerShell.
Connect-MgGraph -Scopes GroupMember.Read.All

Error Get-MgGroupMemberAsGroup : One or more errors occurred.

This error typically occurs when you have multiple versions of the MS Graph PowerShell module installed. To identify the available versions of the Microsoft Graph PowerShell module, run the following cmdlet.

Get-Module -Name Microsoft.Graph -ListAvailable

Fix To fix the problem, you need to uninstall all the older versions of the module which help resolve the issue.

Uninstall-Module -Name "Microsoft.Graph" -RequiredVersion $Version -Force

Error Microsoft 365 groups are not allowed.

This error occurs when attempting to nest Microsoft 365 Groups in Entra ID, but since Microsoft 365 Groups nesting is not supported, the action fails.

Fix Ensure that you are only nesting security groups or distribution lists, as Microsoft 365 Groups cannot be nested within other groups.

Error ./M365NestedGroups.ps1 cannot be loaded because running scripts is disabled on this system.

If you have set the execution policy settings to 'RemoteSigned', the above error will occur when running the PowerShell script.

Fix Change the execution policy by running the cmdlet below.

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted

Error Failed to remove group membership.

This error occurs when trying to remove the group membership of a distribution list from another distribution list in Microsoft Entra ID.

Fix Use the Exchange Online admin center, as Entra ID doesn't manage distribution list memberships. You can also use the Exchange Online PowerShell cmdlet to remove DL members.

Remove-DistributionGroupMember -Identity "DLName" -Member "MemberName"

Azure AD

Frequently Asked Questions

Manage Nested Groups in Microsoft 365 to Streamline Access Management Effectively

How to create a nested group in Entra Admin Center?

Can distribution groups be nested in Microsoft 365?

What are the benefits and limitations of nested groups in Azure AD?

How to assign licenses to nested group members in Microsoft 365?

1. How to create a nested group in Entra Admin Center?

Nested groups in Microsoft 365 allow you to enhance access management by adding one group as a member of another group. It supports various scenarios, including group membership claims, Conditional Access policies assignments, and manage access permissions on self-service password resets and Microsoft Entra device registrations.

Steps to create a nested group in the Entra Admin Center

Navigate to All groups under Identity»Groups in the Microsoft Entra admin center.
Click on New group and select the Group type as Security.
Enter the Group name and select Membership type as Assigned.
Click on the link under Members and select a group that you want to nest in this group & click 'Select'.
Then, hit the 'Create' button to create a parent group with groups nested under it.

While Microsoft 365 admin portals lack the ability to audit nested group management activities, AdminDroid offers a robust solution!

In AdminDroid's Group Member Changes report, use the Advanced customization to display items where "Operation" as "Add Group Member" and "Added/Removed User" starts with "Group".
This granular filtering enables you to easily audit the nested group creations with details, such as activity time, group name, operation, result status, activity performed on, performed by, etc.

audit-group-nesting-activities-admindroid

2. Can distribution groups be nested in Microsoft 365?

Yes, creating nested distribution groups in Microsoft 365 enables efficient management of email communications by organizing multiple groups under a single parent distribution list. It simplifies the process of sending emails to a larger audience and maintains organized group memberships for better communication within your organization.

Steps to create nested distribution group using Exchange admin center

Navigate to Distribution list tab under Recipients»Groups in the Exchange admin center.
Click the group where you want to nest another group.
In the side pane, choose Members tab and select 'View all and manage members' to see all members of the group.
Click Add Members to select the groups that you want to include as members of this group.
Finally, click 'Add' button to create a nested distribution list in Microsoft 365.

Steps to create nested distribution group using PowerShell

To create a nested distribution group, first connect to the Exchange Online PowerShell.

Connect-ExchangeOnline

Then, run the below cmdlet to add a group as a member of another group.

Add-DistributionGroupMember -Identity <ParentGroup> -Member <NestedGroup>

Moreover, you can use the script below to export a report of all nested distribution group members in Microsoft 365.

GetNestedDistributionGroupMembers.ps1

With AdminDroid, you can easily export nested distribution groups report in various formats such as HTML, PDF, CSV, XLS, and XLSX.

Utilize the AdminDroid’s Distribution Group Members report with "Member Type" filter as "Group" to access the nested distribution groups in your Microsoft 365 environment.
This report provides details, such as group name, group mail, nested DL name, nested DL email, member type, etc.

get-nested-distribution-group-report-admindroid

Pro Tip: Click on the Download/Export icon to download the report in your desired format.

3. What are the benefits and limitations of nested groups in Azure AD?

While nested groups in Microsoft Entra ID offer several benefits, they also come with certain limitations. Here's a look at both the benefits and limitations.

Benefits of nested groups in Entra ID

Conditional Access: Nested groups are supported when a Conditional Access policy is applied with a group scope.
Self-Service Password Reset: Since SSPR access is limited to a single group, nested groups allow users within them to inherit access, enabling them to perform SSPR.
Device Registration: Nested groups can be used to limit which users can do Microsoft Entra join and device registrations.

Limitations of nested groups in Entra ID

App Role Assignment: Nested group membership and app role assignments to an application are not supported.
Group-based Licensing: Licenses for nested groups do not inherit from their parent groups. You must apply licenses to each nested group individually.
Microsoft 365 Groups: Adding Microsoft 365 groups to security groups and vice versa is not supported.
Azure RBAC Nested Groups: Nesting is currently not supported for groups that can be assigned to a role.

4. How to assign licenses to nested group members in Microsoft 365?

As we know, nested groups do not support group-based licensing in Microsoft Entra ID. However, admins can create dynamic membership groups that automatically include members based on specified attributes. This allows admins to assign licenses to the direct members of nested groups.

Let’s take a scenario:

Imagine you have Group A, which contains Group B and Group C as nested groups. Since licenses assigned to Group A don’t inherit to its child groups due to this nesting, you can create dynamic groups, say 'Dynamic Group D', that automatically include members from Group B and Group C based on the 'memberOf' attribute.

Steps to create a group membership from Azure AD dynamic groups

Navigate to All groups under Identity»Groups in the Microsoft Entra admin center
Click on New group, fill in the group details and select the Group type as Security or Microsoft 365, and the Membership type as dynamic user.
Select the 'Add dynamic query' and click on 'Edit' to write the rule in the Rule syntax box.
user.memberof -any (group.objectId -in ['GroupA_Id', 'GroupB_Id', 'GroupC_Id'])
Click 'OK' and 'Create' to add members of other groups using the memberOf attribute.

By creating dynamic groups in Microsoft Entra ID, you can effectively flatten group membership, allowing direct members of Group A, Group B and Group C to be included in Dynamic group D. Once set up, you can assign licenses to this dynamic group, ensuring other group members receive the proper licenses without facing limitations from nested group structures.