Get-EntraContactMembership

Get-EntraContactMembership

    -OrgContactId <String>
    [-All]
    [-Top <Int32>]
    [-Property <String[]>]
    [<CommonParameters>]

The Get-EntraContactMembership cmdlet gets a contact membership in Microsoft Entra ID.

This command is useful to administrators who need to understand which groups, roles, or administrative units a particular contact belongs to. This can be important for troubleshooting access issues, auditing memberships, and ensuring that contact memberships are correctly configured.

In delegated scenarios with work or school accounts, the signed-in user must have a supported Microsoft Entra role or a custom role with the necessary permissions. The following least privileged roles can be used:

• Directory Readers
• Global Reader
• Directory Writers
• Intune Administrator
• User Administrator

Connect-Entra -Scopes 'OrgContact.Read.All'
$contact = Get-EntraContact -Filter "displayName eq 'Contoso Contact'"
Get-EntraContactMembership -OrgContactId $contact.Id |
Select-Object Id, DisplayName, '@odata.type', SecurityEnabled | Format-Table -AutoSize

Id                                   displayName   @odata.type            securityEnabled
--                                   -----------   -----------            ---------------
ffffffff-5555-6666-7777-aaaaaaaaaaaa All Employees #microsoft.graph.group           False

This command gets all the memberships for specified contact.

Connect-Entra -Scopes 'OrgContact.Read.All'
$contact = Get-EntraContact -Filter "displayName eq 'Contoso Contact'"
Get-EntraContactMembership -OrgContactId $contact.Id -All |
Select-Object Id, DisplayName, '@odata.type', SecurityEnabled | Format-Table -AutoSize

Id                                   displayName   @odata.type            securityEnabled
--                                   -----------   -----------            ---------------
ffffffff-5555-6666-7777-aaaaaaaaaaaa All Employees #microsoft.graph.group           False

This command gets all the memberships for specified contact.

Connect-Entra -Scopes 'OrgContact.Read.All'
$contact = Get-EntraContact -Filter "displayName eq 'Contoso Contact'"
Get-EntraContactMembership -OrgContactId $contact.Id -Top 2 |
Select-Object Id, DisplayName, '@odata.type', SecurityEnabled | Format-Table -AutoSize

Id                                   displayName   @odata.type            securityEnabled
--                                   -----------   -----------            ---------------
ffffffff-5555-6666-7777-aaaaaaaaaaaa All Employees #microsoft.graph.group           False

This command gets top two memberships for specified contact. You can use -Limit as an alias for -Top.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.