Skip to main content

Get-MgRoleReport

SYNOPSIS​

Get-MgRoleReport.ps1 - Reports on Microsoft Entra ID (Azure AD) roles

SYNTAX​

Get-MgRoleReport [-IncludeEmptyRoles] [[-IncludePIMEligibleAssignments] <Boolean>] [-ForceNewToken]
 [-MaesterMode] [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION​

By default, the report contains only the roles with members. To get all the role, included empty roles, add -IncludeEmptyRoles $true

EXAMPLES​

EXAMPLE 1​

Get-MgRoleReport

Get all the roles with members, including PIM eligible assignments but without empty roles

EXAMPLE 2​

Get-MgRoleReport -IncludeEmptyRoles

Get all the roles, including the ones without members

EXAMPLE 3​

Get-MgRoleReport -IncludePIMEligibleAssignments $false
Get all the roles with members (without empty roles), but without PIM eligible assignments

EXAMPLE 4​

Get-MgRoleReport | Export-CSV -NoTypeInformation "$(Get-Date -Format yyyyMMdd)_adminRoles.csv" -Encoding UTF8

PARAMETERS​

-IncludeEmptyRoles​

Switch parameter to include empty roles in the report

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-IncludePIMEligibleAssignments​

Boolean parameter to include PIM eligible assignments in the report. Default is $true

Type: Boolean
Parameter Sets: (All)
Aliases:

Required: False
Position: 1
Default value: True
Accept pipeline input: False
Accept wildcard characters: False

-ForceNewToken​

Switch parameter to force getting a new token from Microsoft Graph

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-MaesterMode​

Switch parameter to use with the Maester framework (internal process not presented here)

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction​

{{ Fill ProgressAction Description }}

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

The report is output to an array contained all the audit logs found.​

To export in a csv, do Get-MgRoleReport | Export-CSV -NoTypeInformation "$(Get-Date -Format yyyyMMdd)_adminRoles.csv" -Encoding UTF8​

NOTES​

Written by Bastien Perez (Clidsys.com - ITPro-Tips.com) For more Office 365/Microsoft 365 tips and news, check out ITPro-Tips.com.

Version History:

[1.8.2] - 2025-10-17​

Changed​

  • Fix onPremisesSyncEnabled property

[1.8.1] - 2025-10-17​

Added​

  • Add RecommendationSync property

[1.8.0] - 2025-10-08​

Added​

  • Add IncludeEmptyRoles switch parameter to get all roles, even the ones without members

Changed​

  • Use List for mgRoles for better performance

[1.7.0] - 2025-04-04​

Changed​

  • Add scopes for RoleManagement.Read.All and AuditLog.Read.All permissions

[1.6] - 2025-02-26​

Changed​

  • Add permissionsNeeded variable
  • Add onpremisesSyncEnabled property for groups
  • Add all type objects in the cache array
  • Add LastNonInteractiveSignInDateTime property for users

[1.5.0] - 2025-02-25​

Changed​

  • Always return true or false for onPremisesSyncEnabled properties
  • Fix issues with objectsCacheArray that was not working
  • Sign-in activity tracking for service principals

Plannned for next release​

  • Switch to Invoke-MgGraphRequest instead of Get-Mg* CMDlets

[1.4.0] - 2025-02-13​

Added​

  • Sign-in activity tracking for users
  • Account enabled status.
  • On-premises sync enabled status.
  • Remove old parameters
  • Test if already connected to Microsoft Graph and with the right permissions

[1.3.0] - 2024-05-15​

Changed​

  • Changes not specified.

[1.2.0] - 2024-03-13​

Changed​

  • Changes not specified.

[1.1.0] - 2023-12-01​

Changed​

  • Changes not specified.

[1.0.0] - 2023-10-19​

Initial Release​

https://itpro-tips.com/get-the-office-365-admin-roles-and-track-the-changes/