Namespace: microsoft.graph
Return all the group IDs for the groups that the specified user, group, service principal, organizational contact, device, or directory object is a member of. This function is transitive.
This API returns up to 11,000 group IDs. If more than 11,000 results are available, it returns a 400 Bad Request
error with the Directory_ResultSizeLimitExceeded
error code. If you get the Directory_ResultSizeLimitExceeded
error code, use the List group transitive memberOf API instead.
This API is available in the following national cloud deployments.
Global service |
US Government L4 |
US Government L5 (DOD) |
China operated by 21Vianet |
✅ |
✅ |
✅ |
✅ |
Permissions
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Permissions.
Group memberships for a directory object
Here, the permission allows you to read any directory object, regardless of the object type. To scope the operation to a specific object type and use lesser-privileged permissions, refer to other permissions tables on this page.
Permission type |
Permissions (from least to most privileged) |
Delegated (work or school account) |
Directory.Read.All |
Delegated (personal Microsoft account) |
Not supported. |
Application |
Directory.Read.All |
Group memberships for a user
Permission type |
Permissions (from least to most privileged) |
Delegated (work or school account) |
User.ReadBasic.All and GroupMember.Read.All, User.Read.All and GroupMember.Read.All, User.ReadBasic.All and Group.Read.All, User.Read.All and Group.Read.All, Directory.Read.All |
Delegated (personal Microsoft account) |
Not supported. |
Application |
User.ReadBasic.All and GroupMember.Read.All, User.Read.All and GroupMember.Read.All, User.ReadBasic.All and Group.Read.All, User.Read.All and Group.Read.All, Directory.Read.All |
Group memberships for a group
Permission type |
Permissions (from least to most privileged) |
Delegated (work or school account) |
GroupMember.Read.All, Group.Read.All, Directory.Read.All, Group.ReadWrite.All, Directory.ReadWrite.All |
Delegated (personal Microsoft account) |
Not supported. |
Application |
GroupMember.Read.All, Group.Read.All, Directory.Read.All, Group.ReadWrite.All, Directory.ReadWrite.All |
Group memberships for a service principal
Permission type |
Permissions (from least to most privileged) |
Delegated (work or school account) |
Application.Read.All, Directory.Read.All, Application.ReadWrite.All, Directory.ReadWrite.All |
Delegated (personal Microsoft account) |
Not supported. |
Application |
Application.Read.All, Directory.Read.All, Application.ReadWrite.All, Directory.ReadWrite.All |
Permission type |
Permissions (from least to most privileged) |
Delegated (work or school account) |
Directory.Read.All, Directory.ReadWrite.All |
Delegated (personal Microsoft account) |
Not supported. |
Application |
Directory.Read.All, Directory.ReadWrite.All |
Group memberships for a device
Permission type |
Least privileged permissions |
Higher privileged permissions |
Delegated (work or school account) |
Application.Read.All |
Application.ReadWrite.All, Device.Read.All, Directory.Read.All, Directory.ReadWrite.All, Group.Read.All, Group.ReadWrite.All, GroupMember.Read.All, User.Read.All |
Delegated (personal Microsoft account) |
Not supported. |
Not supported. |
Application |
Application.Read.All |
Application.ReadWrite.All, Device.Read.All, Device.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All, Group.Read.All, Group.ReadWrite.All, GroupMember.Read.All, User.Read.All |
HTTP request
Group memberships for a directory object (user, group, service principal, or organizational contact).
POST /directoryObjects/{id}/getMemberGroups
Group memberships for the signed-in user or other users.
POST /me/getMemberGroups
POST /users/{id | userPrincipalName}/getMemberGroups
Note
Calling the /me
endpoint requires a signed-in user and therefore a delegated permission. Application permissions aren't supported when using the /me
endpoint.
Note
Calling the /me
endpoint requires a signed-in user and therefore a delegated permission. Application permissions aren't supported when using the /me
endpoint.
Group memberships for a group.
POST /groups/{id}/getMemberGroups
Group memberships for a service principal.
POST /servicePrincipals/{id}/getMemberGroups
Group memberships for an organizational contact.
POST /contacts/{id}/getMemberGroups
Group memberships for a device.
POST /devices/{id}/getMemberGroups
Request body
In the request body, provide a JSON object with the following parameters.
Parameter |
Type |
Description |
securityEnabledOnly |
Boolean |
true to specify that only security groups that the entity is a member of should be returned; false to specify that all groups and directory roles that the entity is a member of should be returned. true can be specified only for users or service principals to return security-enabled groups. |
Response
If successful, this method returns 200 OK
response code and String collection object in the response body.
Examples
Example 1: Check group memberships for a directory object
Request
POST https://graph.microsoft.com/v1.0/directoryObjects/0049d944-a805-4680-9f54-3ab292090309/getMemberGroups
Content-type: application/json
{
"securityEnabledOnly": false
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.DirectoryObjects.Item.GetMemberGroups;
var requestBody = new GetMemberGroupsPostRequestBody
{
SecurityEnabledOnly = false,
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.DirectoryObjects["{directoryObject-id}"].GetMemberGroups.PostAsGetMemberGroupsPostResponseAsync(requestBody);
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
mgc directory-objects get-member-groups post --directory-object-id {directoryObject-id} --body '{\
"securityEnabledOnly": false\
}\
'
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
// Code snippets are only available for the latest major version. Current major version is $v1.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
graphdirectoryobjects "github.com/microsoftgraph/msgraph-sdk-go/directoryobjects"
//other-imports
)
requestBody := graphdirectoryobjects.NewGetMemberGroupsPostRequestBody()
securityEnabledOnly := false
requestBody.SetSecurityEnabledOnly(&securityEnabledOnly)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
getMemberGroups, err := graphClient.DirectoryObjects().ByDirectoryObjectId("directoryObject-id").GetMemberGroups().PostAsGetMemberGroupsPostResponse(context.Background(), requestBody, nil)
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
com.microsoft.graph.directoryobjects.item.getmembergroups.GetMemberGroupsPostRequestBody getMemberGroupsPostRequestBody = new com.microsoft.graph.directoryobjects.item.getmembergroups.GetMemberGroupsPostRequestBody();
getMemberGroupsPostRequestBody.setSecurityEnabledOnly(false);
var result = graphClient.directoryObjects().byDirectoryObjectId("{directoryObject-id}").getMemberGroups().post(getMemberGroupsPostRequestBody);
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
const options = {
authProvider,
};
const client = Client.init(options);
const string = {
securityEnabledOnly: false
};
await client.api('/directoryObjects/0049d944-a805-4680-9f54-3ab292090309/getMemberGroups')
.post(string);
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
<?php
use Microsoft\Graph\GraphServiceClient;
use Microsoft\Graph\Generated\DirectoryObjects\Item\GetMemberGroups\GetMemberGroupsPostRequestBody;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new GetMemberGroupsPostRequestBody();
$requestBody->setSecurityEnabledOnly(false);
$result = $graphServiceClient->directoryObjects()->byDirectoryObjectId('directoryObject-id')->getMemberGroups()->post($requestBody)->wait();
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
Import-Module Microsoft.Graph.DirectoryObjects
$params = @{
securityEnabledOnly = $false
}
Get-MgDirectoryObjectMemberGroup -DirectoryObjectId $directoryObjectId -BodyParameter $params
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.directoryobjects.item.get_member_groups.get_member_groups_post_request_body import GetMemberGroupsPostRequestBody
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = GetMemberGroupsPostRequestBody(
security_enabled_only = False,
)
result = await graph_client.directory_objects.by_directory_object_id('directoryObject-id').get_member_groups.post(request_body)
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
Response
The following example shows the response.
Note: The response object shown here might be shortened for readability.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#Collection(Edm.String)",
"value": [
"a8daa1fb-d24c-47d0-9e9e-c99e83394e3e"
]
}
Example 2: Check group memberships for the signed-in user
Request
POST https://graph.microsoft.com/v1.0/me/getMemberGroups
Content-type: application/json
{
"securityEnabledOnly": true
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Me.GetMemberGroups;
var requestBody = new GetMemberGroupsPostRequestBody
{
SecurityEnabledOnly = true,
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Me.GetMemberGroups.PostAsGetMemberGroupsPostResponseAsync(requestBody);
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
// Code snippets are only available for the latest major version. Current major version is $v1.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
graphusers "github.com/microsoftgraph/msgraph-sdk-go/users"
//other-imports
)
requestBody := graphusers.NewItemGetMemberGroupsPostRequestBody()
securityEnabledOnly := true
requestBody.SetSecurityEnabledOnly(&securityEnabledOnly)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
getMemberGroups, err := graphClient.Me().GetMemberGroups().PostAsGetMemberGroupsPostResponse(context.Background(), requestBody, nil)
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
com.microsoft.graph.users.item.getmembergroups.GetMemberGroupsPostRequestBody getMemberGroupsPostRequestBody = new com.microsoft.graph.users.item.getmembergroups.GetMemberGroupsPostRequestBody();
getMemberGroupsPostRequestBody.setSecurityEnabledOnly(true);
var result = graphClient.me().getMemberGroups().post(getMemberGroupsPostRequestBody);
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
const options = {
authProvider,
};
const client = Client.init(options);
const string = {
securityEnabledOnly: true
};
await client.api('/me/getMemberGroups')
.post(string);
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
<?php
use Microsoft\Graph\GraphServiceClient;
use Microsoft\Graph\Generated\Users\Item\GetMemberGroups\GetMemberGroupsPostRequestBody;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new GetMemberGroupsPostRequestBody();
$requestBody->setSecurityEnabledOnly(true);
$result = $graphServiceClient->me()->getMemberGroups()->post($requestBody)->wait();
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
Import-Module Microsoft.Graph.Users.Actions
$params = @{
securityEnabledOnly = $true
}
# A UPN can also be used as -UserId.
Get-MgUserMemberGroup -UserId $userId -BodyParameter $params
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.users.item.get_member_groups.get_member_groups_post_request_body import GetMemberGroupsPostRequestBody
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = GetMemberGroupsPostRequestBody(
security_enabled_only = True,
)
result = await graph_client.me.get_member_groups.post(request_body)
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
Response
Note: The response object shown here might be shortened for readability.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#Collection(Edm.String)",
"value": [
"6239671a-0db6-4e8b-9d2f-f280efb5a181",
"2e2f1227-1586-45ae-bf51-fccc1de72625",
"1dae9306-be75-4c3c-99ec-0316a4342c84",
"0e2d1bbb-76f8-4140-bda7-2a858b74507e",
"0049d944-a805-4680-9f54-3ab292090309",
"a8daa1fb-d24c-47d0-9e9e-c99e83394e3e",
"6f204729-1b8f-4067-bcc9-98fb6c069ffd",
"59afd38d-441a-4358-b074-8b9b1e7de52f",
"64ed3df3-53c7-4d4d-ac5c-5c8dd4dafe33",
"8b676bab-4b1e-419e-a253-7f5aca97d739",
"be4ef325-9fa8-40d7-b375-4758853ddf52",
"f5987b5a-61f6-4c31-9fa2-7bfb845c8d2a"
]
}