Microsoft Entra ID

How to Find All Microsoft 365 Groups with Hidden Membership

Microsoft 365 hidden membership groups protect sensitive collaborations by concealing member lists. It's crucial to verify who belongs to these groups, as unauthorized members can expose all other members and confidential data. However, manually auditing these groups is a time-consuming and error-prone process. This guide provides simple ways to find all groups with hidden membership in your organization along with their members.

Find Groups with Hidden Membership Using M365 Admin Center

Microsoft Permission

Global Reader Least Privilege

Global Administrator Most Privilege

Sign in to the Microsoft 365 admin center.
Navigate to Teams & groups»Active teams & groups»Teams & Microsoft 365 groups.
Here, you can view all Microsoft 365 groups in your organization. To identify those with hidden membership, check the Privacy column and look for entries labeled as HiddenMembership.
Now, select the hidden membership group and go to the Membership»Members tab in its details pane to view the members of the group.

Find Groups with Hidden Membership Using M365 Admin Center

View M365 Hidden Membership Groups Using Exchange Admin Center

Microsoft 365 Permission Required

Global Reader Least Privilege

Global Administrator Most Privilege

Sign in to the Exchange admin center.
Navigate to the Recipients»Groups»Microsoft 365.
It displays all Microsoft 365 groups in your organization. To spot groups with hidden membership, refer to the Group privacy column and look for entries marked as ‘HiddenMembership'.
Select a hidden membership group and go to the Members tab to view all group members.

View M365 Hidden Membership Groups Using Exchange Admin Center

Get Hidden Group Membership in M365 Using PowerShell

Microsoft 365 Permission Required

Global Reader Least Privilege

Global Administrator Most Privilege

Connect to the Exchange Online PowerShell using the cmdlet below.
Windows PowerShell
```
 Connect-ExchangeOnline
```
Run the following cmdlet to retrieve all Microsoft 365 groups with hidden membership along with the group members.

Windows PowerShell

 Get-UnifiedGroup | Where-Object { $_.HiddenGroupMembershipEnabled -eq $true } |
ForEach-Object { 
  $group = $_ 
Get-UnifiedGroupLinks -Identity $group.Identity -LinkType Members |
   ForEach-Object {
    [PSCustomObject]@{
           GroupName      = $group.DisplayName
            MemberName  = $_.DisplayName
            MemberEmail   = $_.PrimarySmtpAddress
            } } } | Format-Table -AutoSize

Get Hidden Group Membership in M365 Using PowerShell

Simple & Quick
List M365 Hidden Membership Groups Using AdminDroid

AdminDroid Permission Required Delegated

Any user with the report access delegated by the Super Admin.

Log in to the AdminDroid 365 portal.
Navigate to the Microsoft 365 Groups with Hidden Membership report under Reports»Entra»Insights»Users & Groups Activities»Microsoft 365 Groups»Group with Hidden Membership.
This report lists the hidden membership groups along with detailed insights such as group display name, group membership type, owners count, total members count, and more.
In the ‘Total Members Count’ column, hover over the count for a group and select Quick Actions»Open in Nested View. This lists all members of the particular hidden membership group in expanded view.

List M365 Hidden Membership Groups Using AdminDroid

AdminDroid Microsoft 365 Groups Reporting

Spot Hidden Membership in Microsoft 365 Groups to Close Visibility Gaps and Tighten Access Controls!

AdminDroid’s Microsoft 365 group reporting tool gives you complete visibility into groups with hidden membership in just a few clicks. It uncovers every detail across Microsoft 365 groups, distribution lists, security groups, and more, to ensure no hidden membership goes unnoticed. With its detailed real-time insights, you can strengthen governance, simplify administration, and maintain full control over group management.

Ensure Sensitive Teams Membership Are Hidden to Protect Confidential Information

Use the hidden membership teams report to ensure memberships of all required sensitive teams are hidden and files are accessible only to the right members.

Identify Hidden Membership in Distribution Lists Using Rich Filtering

Utilize AdminDroid’s advanced filtering to find all distribution lists with hidden memberships and get complete group details including members, owners, guests, and more.

Review Dynamic Group Hidden Membership to Avoid Unintended Member Exposure

Check groups with membership rules for dynamic hidden memberships to prevent automated rule updates from exposing confidential memberships during role changes, transfers, or department moves.

Monitor External Access in Hidden Group Memberships to Ensure Compliance

Track external membership changes in groups with hidden members to ensure external access is limited to the intended duration and mitigate exposure of contributors outside the organization.

Maintain Control Over Ownership Changes in Hidden Membership Groups

Deploy the pre-built group owner changes alert policy to monitor any shifts in ownership of hidden membership groups instantly and avoid unauthorized owners from compromising the group’s privacy.

Identify Inactive Hidden Membership Groups to Eliminate Silent Access Risks

Analyze the last active time of groups to spot inactive hidden membership groups that still retain access permissions and retire them to prevent unnoticed entry points and compliance risks.

In conclusion, AdminDroid’s Entra ID management tool equips you with powerful insights to simplify Microsoft 365 group management. It uncovers hidden access, strengthens group visibility and enforces secure collaboration. It also streamlines group ownership and membership for better organizational control.

Explore a full range of reporting options

Download Live Demo

Important tips

Manage self-service group creation in Microsoft Entra ID to restrict the creation of Microsoft 365 groups and prevent unauthorized hidden membership groups in your organization.

Apply per-group guest access controls to block new guest additions in hidden membership groups and keep sensitive spaces secure while still enabling external collaboration.

Configure PIM access reviews on hidden membership groups to automatically remove inactive users and stop dormant access from turning into a security gap.

Common Errors and Resolution Steps

The following are the possible errors and troubleshooting hints when tracking a report on hidden group membership in Microsoft 365.

Error Only a Private group can be marked with hidden membership.

This error occurs in PowerShell because hidden memberships in Microsoft 365 groups can’t be set to public, either during or after creation.

Fix Set the group access type to Private while creating hidden membership Microsoft 365 groups.

Error A parameter cannot be found that matches the parameter name 'HiddenGroupMembershipEnabled'.

This issue occurs when you try to enable hidden group membership on an existing Microsoft 365 group.

Fix Hidden membership cannot be enabled for existing Microsoft 365 groups, so consider creating a new group with hidden membership enabled and migrating the members.

Error The term 'Get-Team' is not recognized as the name of a cmdlet, function, script file, or operable program.

This error occurs when Microsoft Teams PowerShell module is not installed or not imported in your current session.

Fix Install and connect to the Microsoft Teams using the below cmdlets before running any cmdlet related to Teams.

# Install the Microsoft Teams module
Install-Module -Name MicrosoftTeams -Force -AllowClobber

# Import the Microsoft Teams module into the current session
Import-Module MicrosoftTeams

# Connect to the Microsoft Teams with an interactive login prompt 
Connect-MicrosoftTeams

Error A positional parameter cannot be found that accepts the argument 'True'.

This error occurs when PowerShell receives a value without a matching parameter. It usually happens if a parameter is missing or incorrectly specified.

Fix Include colon (:) after the parameter name -HiddenGroupMembershipEnabled to avoid ambiguity in certain shells or editors.

Set-DistributionGroup -Identity “Meeting” -HiddenGroupMembershipEnabled:$true

Microsoft Entra ID

Frequently Asked Questions

Manage Hidden Members in Microsoft 365 Groups to Strengthen Confidential Group Governance

How to hide members in Microsoft 365 groups?

What are the differences between hidden group and hidden group membership in Microsoft 365?

How to hide a group from the Global Address List (GAL) in Microsoft 365?

How to hide distribution list members in Microsoft 365?

How to create teams with hidden group membership?

How to hide group membership of security groups?

1. How to hide members in Microsoft 365 groups?

Imagine a Microsoft 365 group handling confidential mergers and acquisitions discussion. If memberships are visible, unauthorized users could identify key decision-makers and misuse the information. That’s why hiding members of these groups is critical. This preserves confidentiality, minimizes internal exposure, safeguards member identities, and keeps sensitive projects secure.

Key considerations for hidden membership in Microsoft 365 groups

Members of Microsoft 365 groups can be hidden only using PowerShell.
Hidden memberships for Microsoft 365 groups can only be enabled during the group creation. It cannot be configured for any existing M365 group.
The setting HiddenGroupMembershipEnabled:$true is immutable, it cannot be turned off once it is enabled.

Hide group members in Microsoft 365 using PowerShell

Connect to the Exchange Online PowerShell using the cmdlet below.

Connect-ExchangeOnline

Create a Microsoft 365 group with hidden membership using the cmdlet below.

New-UnifiedGroup -DisplayName "<GroupName>" -Members “<GroupMemberUPN>” -AccessType "Private" -HiddenGroupMembershipEnabled

Replace <GroupName> with the desired name for the group and <GroupMemberUPN> with the user principal name of the user you want to add to the group.

Handy Tip: You can add multiple users to the group in bulk by specifying their UPN as comma-separated values like "amy@contoso.com", "berline@contoso.com" in the -Members parameter.

2. What are the differences between hidden group and hidden group membership in Microsoft 365?

In Microsoft 365, hidden groups and hidden group membership may sound similar, but they serve distinct purposes. Knowing the difference allows you to make informed decisions about group visibility and privacy.

hidden-&-hidden-membership-group-differences

3. How to hide a group from the Global Address List (GAL) in Microsoft 365?

Admins can hide Microsoft 365 groups from the Global Address List (GAL) to protect sensitive groups. This prevents regular users or potential attackers from discovering legal groups, reduces internal exposure, and ensures confidentiality for critical or high-security operations.

Hide M365 group from Global Address List using Microsoft 365 admin center

Navigate to the Active teams & groups page in Microsoft 365 admin center.
Select a group you want to hide from GAL and go to the Settings tab in the group details pane.
Choose Don’t show team email address in Outlook option under the Email section and click Save to hide the group from GAL.

Hide groups in Microsoft 365 from GAL using Exchange admin center

Navigate to Groups section in the Exchange admin center.
Select any group from the list you want to hide and go to the Settings tab.
Under the General settings, choose the ‘Hide this group from the global address list’ option and click Save to apply the changes.

Hide groups from GAL in Microsoft 365 using PowerShell

Connect to the Exchange Online and run the cmdlet below to hide a group from the Global Address List.

Set-UnifiedGroup -Identity "<GroupName>" -HiddenFromAddressListsEnabled:$true

Replace <GroupName> with the name of the group you want to hide from GAL.

Note: When you hide a group from the Global Address List (GAL), it can take up to 24 hours for the change to fully reflect across all clients and systems. This includes applications like Outlook, Teams, and the GAL itself.

4. How to hide distribution list members in Microsoft 365?

Distribution lists in Microsoft 365 streamline communication across departments, but when high-level groups like executive teams use them, visibility becomes a risk. Exposed member lists can reveal sensitive contacts and make executives prime targets for phishing or social engineering. By hiding distribution list members, organizations can safeguard confidential information while maintaining seamless collaboration.

Hide distribution group membership using PowerShell

Connect to the Exchange Online PowerShell using the cmdlet below.

Connect-ExchangeOnline

Run the following cmdlet to create a new distribution group with hidden membership.

New-DistributionGroup -Name "<GroupName>" -Members "<GroupMemberUPN>" -HiddenGroupMembershipEnabled:$True

Replace <GroupName> with a suitable name for your distribution list and <GroupMemberUPN> with the user principal name of the user(s) you want to add to the group.

To hide the members of an existing distribution list, run the cmdlet below.

Set-DistributionGroup -Identity "<GroupUPN>" -HiddenGroupMembershipEnabled:$true

Replace <GroupUPN> with an existing distribution group name/email address. You can change the visibility and make the distribution list members visible again by setting the -HiddenGroupMembershipEnabled to $False.

5. How to create teams with hidden group membership?

Teams are central hubs where users share files, hold discussions, and collaborate on projects. If member lists are visible, insiders could identify high-value targets and try to hack their accounts to steal confidential files or discussions. Therefore, it’s essential to keep membership hidden, as this prevents risks and reduces the likelihood of targeted attacks and insider threats.

You can create a team with hidden membership or add teams to the existing hidden membership group based on your requirements.

Add teams to existing Microsoft 365 group with hidden memberships

Log in to the Microsoft 365 admin center and navigate to Teams & groups»Active teams & groups»Teams & Microsoft 365 Groups.
Select the Microsoft 365 group with hidden membership where you want to add a team.
Click ‘Add Teams’ at the General tab to create a team from an existing group.
Now, click Add Teams on the confirmation page to attach a team to the group instantly.

Create team with hidden membership in Microsoft 365 using PowerShell

Connect to the Microsoft Teams using the cmdlet below.

Connect-MicrosoftTeams

Run the cmdlet below by replacing <TeamName> to create a new team with hidden membership.

New-Team -DisplayName "<TeamName>" -Visibility HiddenMembership

The above cmdlet will create a Microsoft 365 team with hidden membership automatically.

6. How to hide group membership of security groups?

Standard security groups do not support hidden memberships in Microsoft 365. To achieve similar functionality, you can create and hide a mail-enabled security group. This approach gives you the same control and security as a regular security group while keeping the membership list hidden.

Hide group membership for mail-enabled security groups using PowerShell

Connect to the Exchange Online and run the cmdlet below by replacing <GroupName> with the desired name for the group to create a mail enabled security group.

New-DistributionGroup -Name "<GroupName>" -Type Security -HiddenGroupMembershipEnabled:$true

To hide the group members of an existing mail-enabled security group, run the cmdlet below.

Set-DistributionGroup -Identity "<GroupName>" -HiddenGroupMembershipEnabled:$true

Replace <GroupName> with the name of UPN of the existing mail-enabled security group.

Unlike Microsoft 365 groups, mail-enabled hidden membership groups can’t be viewed directly in the UI, you must run PowerShell cmdlet to find them.
Run the following cmdlet to get all mail-enabled security groups with hidden membership.

Get-DistributionGroup -ResultSize Unlimited |
Where-Object {
    $_.RecipientTypeDetails -eq 'MailUniversalSecurityGroup' -and
    $_.HiddenGroupMembershipEnabled -eq $true
} | Select-Object Name, PrimarySmtpAddress, HiddenGroupMembershipEnabled

Break free from Microsoft’s visibility limits with AdminDroid! View all mail-enabled security groups with hidden membership in seconds.

Use the inbuilt ‘Hidden Group Membership Enabled’ column in the mail-enabled security groups report to instantly identify all groups with hidden membership.
With this report, you can easily view each group’s members, owners, guests, group created time, expiration time, and more.

mail-enabled-groups-with-hidden-membership

How to Find All Microsoft 365 Groups with Hidden Membership

Find Groups with Hidden Membership Using M365 Admin Center

View M365 Hidden Membership Groups Using Exchange Admin Center

Get Hidden Group Membership in M365 Using PowerShell

Simple & Quick List M365 Hidden Membership Groups Using AdminDroid

Spot Hidden Membership in Microsoft 365 Groups to Close Visibility Gaps and Tighten Access Controls!

Ensure Sensitive Teams Membership Are Hidden to Protect Confidential Information

Identify Hidden Membership in Distribution Lists Using Rich Filtering

Review Dynamic Group Hidden Membership to Avoid Unintended Member Exposure

Monitor External Access in Hidden Group Memberships to Ensure Compliance

Maintain Control Over Ownership Changes in Hidden Membership Groups

Identify Inactive Hidden Membership Groups to Eliminate Silent Access Risks

Important tips

Manage self-service group creation in Microsoft Entra ID to restrict the creation of Microsoft 365 groups and prevent unauthorized hidden membership groups in your organization.

Apply per-group guest access controls to block new guest additions in hidden membership groups and keep sensitive spaces secure while still enabling external collaboration.

Configure PIM access reviews on hidden membership groups to automatically remove inactive users and stop dormant access from turning into a security gap.

Common Errors and Resolution Steps

Error Only a Private group can be marked with hidden membership.

Error A parameter cannot be found that matches the parameter name 'HiddenGroupMembershipEnabled'.

Error The term 'Get-Team' is not recognized as the name of a cmdlet, function, script file, or operable program.

Error A positional parameter cannot be found that accepts the argument 'True'.

Manage Hidden Members in Microsoft 365 Groups to Strengthen Confidential Group Governance

1. How to hide members in Microsoft 365 groups?

Key considerations for hidden membership in Microsoft 365 groups

Hide group members in Microsoft 365 using PowerShell

2. What are the differences between hidden group and hidden group membership in Microsoft 365?

3. How to hide a group from the Global Address List (GAL) in Microsoft 365?

Hide M365 group from Global Address List using Microsoft 365 admin center

Hide groups in Microsoft 365 from GAL using Exchange admin center

Hide groups from GAL in Microsoft 365 using PowerShell

4. How to hide distribution list members in Microsoft 365?

Hide distribution group membership using PowerShell

5. How to create teams with hidden group membership?

Add teams to existing Microsoft 365 group with hidden memberships

Create team with hidden membership in Microsoft 365 using PowerShell

6. How to hide group membership of security groups?

Hide group membership for mail-enabled security groups using PowerShell

Kickstart Your Journey With AdminDroid

Simple & Quick
List M365 Hidden Membership Groups Using AdminDroid

Kickstart Your Journey With
AdminDroid