List users, groups, or devices in an administrative unit

Article
05/23/2025

In Microsoft Entra ID, you can list the users, groups, or devices in administrative units.

Prerequisites

Microsoft Entra ID P1 or P2 license for each administrative unit administrator
Microsoft Entra ID Free licenses for administrative unit members
Microsoft Graph PowerShell module when using PowerShell

For more information, see Prerequisites to use PowerShell.

Admin center
PowerShell

You can list the users, groups, or devices in administrative units using the Microsoft Entra admin center.

List the administrative units for a single user, group, or device

Sign in to the Microsoft Entra admin center.
Browse to Identity.
Browse to one of the following:
- Users > All users
- Groups > All groups
- Devices > All devices
Select the user, group, or device you want to list their administrative units.
Select Administrative units to list all the administrative units where the user, group, or device is a member.

List the users, groups, or devices for a single administrative unit

Sign in to the Microsoft Entra admin center.
Browse to Identity > Roles & admins > Admin units.
Select the administrative unit that you want to list the users, groups, or devices for.
Select one of the following:
- Users
- Groups
- Devices

List the devices for an administrative unit by using the All devices page

Sign in to the Microsoft Entra admin center.
Browse to Identity > Devices > All devices.
Select the filter for administrative unit.
Select the administrative unit whose devices you want to list.

List the restricted management administrative units for a single user or group

Sign in to the Microsoft Entra admin center.
Browse to Identity.
Browse to one of the following:
- Users > All users
- Groups > All groups
Select the user or group you want to list their restricted management administrative units.
Select Administrative units to list all the administrative units where the user or group is a member.
In the Restricted management column, look for administrative units that are set to Yes.

Use the Get-MgDirectoryAdministrativeUnit and Get-MgDirectoryAdministrativeUnitMember commands to list users, groups, or devices for an administrative unit.

Note

By default, Get-MgDirectoryAdministrativeUnitMember returns only top members of an administrative unit. To retrieve all members, add the -All:$true parameter.

List the administrative units for a user

$userObj = Get-MgUser -Filter "UserPrincipalName eq 'bill@example.com'"
Get-MgDirectoryAdministrativeUnit | `
   where { Get-MgDirectoryAdministrativeUnitMember -AdministrativeUnitId $_.Id | `
   where {$_.Id -eq $userObj.Id} }

List the administrative units for a group

$groupObj = Get-MgGroup -Filter "DisplayName eq 'TestGroup'"
Get-MgDirectoryAdministrativeUnit | `
   where { Get-MgDirectoryAdministrativeUnitMember -AdministrativeUnitId $_.Id | `
   where {$_.Id -eq $groupObj.Id} }

List the administrative units for a device

$deviceObj = Get-MgDevice -Filter "DisplayName eq 'Test device'"
Get-MgDirectoryAdministrativeUnit | `
   where { Get-MgDirectoryAdministrativeUnitMember -AdministrativeUnitId $_.Id | `
   where {$_.Id -eq $deviceObj.Id} }

List the users, groups, and devices for an administrative unit

$adminUnitObj = Get-MgDirectoryAdministrativeUnit -Filter "DisplayName eq 'Test administrative unit 2'"
Get-MgDirectoryAdministrativeUnitMember -AdministrativeUnitId $adminUnitObj.Id

List the groups for an administrative unit

$adminUnitObj = Get-MgDirectoryAdministrativeUnit -Filter "DisplayName eq 'Test administrative unit 2'"
foreach ($member in (Get-MgDirectoryAdministrativeUnitMember -AdministrativeUnitId $adminUnitObj.Id)) 
{
    if($member.AdditionalProperties."@odata.type" -eq "#microsoft.graph.group")
    {
        Get-MgGroup -GroupId $member.Id
    }
}

List the devices for an administrative unit

$adminUnitObj = Get-MgDirectoryAdministrativeUnit -Filter "DisplayName eq 'Test administrative unit 2'"
foreach ($member in (Get-MgDirectoryAdministrativeUnitMember -AdministrativeUnitId $adminUnitObj.Id)) 
{
    if($member.AdditionalProperties.ObjectType -eq "Device")
    {
        Get-MgDevice -DeviceId $member.Id
    }
}

AI Skills Fest

Prerequisites

List the administrative units for a single user, group, or device

List the users, groups, or devices for a single administrative unit

List the devices for an administrative unit by using the All devices page

List the restricted management administrative units for a single user or group

List the administrative units for a user

List the administrative units for a group

List the administrative units for a device

List the users, groups, and devices for an administrative unit

List the groups for an administrative unit

List the devices for an administrative unit

Next steps

List users, groups, or devices in an administrative unit

Prerequisites

List the administrative units for a single user, group, or device

List the users, groups, or devices for a single administrative unit

List the devices for an administrative unit by using the All devices page

List the restricted management administrative units for a single user or group

Additional resources