Edit

Share via

Get-EntraContactMembership

  • Reference
Module:
Microsoft.Entra

Get a contact membership.

Syntax

Get-EntraContactMembership
   -OrgContactId <String>
   [-All]
   [-Top <Int32>]
   [-Property <String[]>]
   [<CommonParameters>]

Description

The Get-EntraContactMembership cmdlet gets a contact membership in Microsoft Entra ID.

This command is useful to administrators who need to understand which groups, roles, or administrative units a particular contact belongs to. This can be important for troubleshooting access issues, auditing memberships, and ensuring that contact memberships are correctly configured.

In delegated scenarios with work or school accounts, the signed-in user must have a supported Microsoft Entra role or a custom role with the necessary permissions. The following least privileged roles can be used:

  • Directory Readers
  • Global Reader
  • Directory Writers
  • Intune Administrator
  • User Administrator

Examples

Example 1: Get the memberships of a contact

Connect-Entra -Scopes 'OrgContact.Read.All'
$contact = Get-EntraContact -Filter "displayName eq 'Contoso Contact'"
Get-EntraContactMembership -OrgContactId $contact.Id | 
Select-Object Id, DisplayName, '@odata.type', SecurityEnabled | Format-Table -AutoSize

Id                                   displayName   @odata.type            securityEnabled
--                                   -----------   -----------            ---------------
ffffffff-5555-6666-7777-aaaaaaaaaaaa All Employees #microsoft.graph.group           False

This command gets all the memberships for specified contact.

Example 2: Get all memberships of a contact

Connect-Entra -Scopes 'OrgContact.Read.All'
$contact = Get-EntraContact -Filter "displayName eq 'Contoso Contact'"
Get-EntraContactMembership -OrgContactId $contact.Id -All | 
Select-Object Id, DisplayName, '@odata.type', SecurityEnabled | Format-Table -AutoSize

Id                                   displayName   @odata.type            securityEnabled
--                                   -----------   -----------            ---------------
ffffffff-5555-6666-7777-aaaaaaaaaaaa All Employees #microsoft.graph.group           False

This command gets all the memberships for specified contact.

Example 3: Get top two memberships of a contact

Connect-Entra -Scopes 'OrgContact.Read.All'
$contact = Get-EntraContact -Filter "displayName eq 'Contoso Contact'"
Get-EntraContactMembership -OrgContactId $contact.Id -Top 2 | 
Select-Object Id, DisplayName, '@odata.type', SecurityEnabled | Format-Table -AutoSize

Id                                   displayName   @odata.type            securityEnabled
--                                   -----------   -----------            ---------------
ffffffff-5555-6666-7777-aaaaaaaaaaaa All Employees #microsoft.graph.group           False

This command gets top two memberships for specified contact.

Parameters

-All

List all pages.

Type:System.Management.Automation.SwitchParameter
Position:Named
Default value:False
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-OrgContactId

Specifies the ID of a contact in Microsoft Entra ID.

Type:System.String
Aliases:ObjectId
Position:Named
Default value:None
Required:True
Accept pipeline input:True
Accept wildcard characters:False

-Property

Specifies properties to be returned.

Type:System.String[]
Aliases:Select
Position:Named
Default value:None
Required:False
Accept pipeline input:False
Accept wildcard characters:False

-Top

Specifies the maximum number of records to return.

Type:System.Int32
Aliases:Limit
Position:Named
Default value:None
Required:False
Accept pipeline input:True
Accept wildcard characters:False