How to Export SharePoint Online Group Membership Changes Report

SharePoint Online groups offer a streamlined approach for managing permissions and regulating access to your documents. Instead of assigning permissions individually to users, you can add users to a SharePoint group and assign required permissions to it. Thus, the given permissions will be assigned to all the group members which streamlines user privilege management and ensures consistent access control across SharePoint Online.

When a new SharePoint Online site is created, the following groups are created automatically.

You can check it by navigating to Settings»Site permissions in your SharePoint Online site.

Additionally, you can create and manage groups in SharePoint Online based on various criteria such as department, project, or specific roles within the organization.

Create a group in SharePoint Online

Delete a group in SharePoint Online

To delete a SharePoint group, simply select the desired group. Choose "Group Settings" under the Settings drop-down menu. Now, click on the Delete option located at the bottom.

You can add users to an existing or newly created SharePoint Online group by following the steps below.

Similarly, to remove users from a SharePoint group, click on the desired user/group. Under the Actions drop-down box, select "Remove Users from Group".

When you create a SharePoint group, everyone on the site can view its members. However, if the group is intended for sensitive roles, you may not want to disclose their identities to other groups' members. In such cases, you can customize the group settings to hide this information.

You can also use PnP PowerShell to hide group membership information in SharePoint Online.

Connect-PnPOnline -Url <DesiredSite’sURL> -Interactive
Set-PnPGroup -Identity "<GroupName>" -OnlyAllowMembersViewMembership:$true

• By consistently reviewing the Updated SharePoint Groups report, you can determine who changed the group's name, who has permission to view or edit group membership, and how membership requests are handled.

Handy Hint: You can refer to the "Modified Properties" column to check the modified settings and revert them if required.

When you add a user to a site or share access with them, they are automatically included in the SharePoint Online members or visitors groups. Therefore, it's crucial to regularly review the list of members in SharePoint groups and identify any unwanted users who may no longer require access.

Check group membership in SharePoint Online

Get SharePoint group membership list using PowerShell

Run the Get-SPOUser cmdlet below to view group membership in SharePoint Online.

Connect-SPOService –Url <SPOAdminCenterURL>
Get-SPOUser -Site "<DesiredSiteURL>" ‐Group "<SharePointGroupName>"

Navigating to each SharePoint group to check its membership details might be a time-consuming task. Similarly, with PowerShell, you need to manually specify each group to view the membership list.

• The SharePoint Group Members report shows all security groups and users added as members of a SharePoint group. You can refer to the "MemberType" column to identify the type of membership.

Handy Hint: Utilize AdminDroid’s easy filter functionality for "User Name" to check the SharePoint groups a user is a member of.

If you feel that a group has excessive or insufficient permissions within a SharePoint site, you can edit their permission levels by following the steps below.

You cannot edit permission levels for default groups directly in SharePoint Online. However, you can customize the SharePoint Online permission levels of these default groups using PowerShell.

Connect-PnPOnline -Url <DesiredSite’sURL> -Interactive
Set-PnPGroup -Identity "<GroupName>" -AddRole "<NewPermission>" -RemoveRole "<OldPermission>"