Microsoft Entra ID groups make it easier to manage permissions, licenses, applications, and access policies across Microsoft 365. As organizations grow, new groups are created for departments, projects, Microsoft Teams, applications, and temporary initiatives. Over time, however, some of these groups lose all their members but continue to exist in the directory.
Although empty groups don’t affect daily operations, they can clutter your Microsoft Entra environment and make administration more difficult. During audits or cleanup activities, administrators often spend time reviewing groups that are no longer being used. If your organization uses a hybrid identity model, you may also need to review synchronized groups that are managed in on-premises Active Directory. In this guide, you’ll learn how to identify empty groups in both cloud-only Microsoft Entra ID environments and hybrid Active Directory environments.
Why You Should Review Empty Groups in Entra ID
Finding empty groups is an important part of maintaining a healthy Microsoft Entra environment. While an empty group doesn’t consume significant resources, it often indicates outdated configurations or abandoned projects.
Regularly reviewing empty groups helps you:
- Remove obsolete groups created for completed projects or temporary access.
- Keep Microsoft Entra ID organised and easier to manage.
- Simplify administrative searches and reporting.
- Reduce confusion when assigning permissions or licenses.
- Improve overall identity governance.
Not every empty group should be deleted. Some organisations intentionally maintain template groups that are populated later. However, reviewing them regularly helps distinguish genuinely unused groups from those that still serve a purpose.
Method 1: How to Find Empty Groups in Microsoft 365 Admin Center
If you only need to verify a handful of groups, the Microsoft 365 Admin Center provides a straightforward way to check whether a group contains members.
After signing in to the Microsoft 365 Admin Center:
- Navigate to Teams & groups > Active teams & groups.
- Select the type of group you want to review.
- Open the group.
- Select the Membership tab.
- Review the list of Owners and Members.
If no members are listed, the group is currently empty.
While this works for a small number of groups, it quickly becomes inefficient in larger environments. The admin center does not provide a filter or report to display only groups with no members. Instead, administrators must open each group one by one to verify its membership. This manual process can become time-consuming when managing hundreds or thousands of groups across the tenant.
Method 2: Find Empty Groups Using Microsoft Graph PowerShell
Microsoft Graph PowerShell provides the most flexible way to identify empty groups in Microsoft Entra ID.
Before you begin, make sure the Microsoft Graph PowerShell is installed on your system. You also need an account with permission to read Microsoft 365 group information. Finally, connect to Microsoft Graph using the appropriate permission scopes before running the commands.
Connect-MgGraph -Scopes "Group.Read.All" The following script retrieves all Microsoft Entra ID groups and displays only those that contain no members.
$groups = Get-MgGroup -All
$emptyGroups = foreach ($group in $groups) {
$members = Get-MgGroupMember -GroupId $group.Id
if ($members.Count -eq 0) {
[PSCustomObject]@{
GroupName = $group.DisplayName
GroupType = if ($group.GroupTypes -contains "Unified") {
"Microsoft 365 Group"
}
elseif ($group.MailEnabled) {
"Distribution Group"
}
else {
"Security Group"
}
}
}
}
$emptyGroupsThe script first retrieves every Microsoft Entra ID group in the tenant. It then checks each group’s membership individually. Whenever a group contains no members, the script records its display name and identifies whether it is a Microsoft 365 Group, Distribution Group, or Security Group.
Method 3: Find Empty Groups in Active Directory Using PowerShell
Many organizations operate in hybrid environments where groups are synchronized from on-premises Active Directory to Microsoft Entra ID. In these environments, synchronized groups are managed in Active Directory, so it’s often useful to identify empty groups directly within your on-premises directory.
The following PowerShell command uses an LDAP filter to return only Active Directory groups that have no members.
Get-ADGroup -SearchBase "OU=YourOU,DC=YourDomain,DC=com" -LDAPFilter "(!member=*)" |
Select-Object Name, DistinguishedNameNote: Replace the -SearchBase value with the distinguished name (DN) of the Organizational Unit (OU) that contains your groups. For example, replace OU=YourOU,DC=YourDomain,DC=com with the appropriate OU path for your Active Directory environment.
The (!member=*) LDAP filter searches for groups where the member attribute is empty. This allows Active Directory to return only empty groups instead of retrieving every group and checking memberships one by one.
Method 4: Find Empty Groups in OnPrem AD Using EasyEntra
For administrators who prefer a graphical interface, EasyEntra provides a simple way to search Active Directory for empty groups without writing PowerShell.
Open the Search page in EasyEntra and use the following LDAP query.
(&(type=group)(!member=*))
This approach is particularly useful for hybrid environments where administrators regularly manage synchronized Active Directory objects and prefer a GUI over scripting!
What Should You Do After Identifying Empty Groups?
Finding empty groups is only the first step. Before deleting any group, it’s important to determine whether it still serves a business purpose.
Consider verifying whether the group:
- Is still referenced by an application or Conditional Access policy.
- Was created as a template for future use.
- Previously supported a Microsoft Team or SharePoint site that is still required.
- Is intentionally being kept empty until new members are added.
Once you’ve confirmed that a group is no longer required, it can be safely removed as part of your regular Microsoft Entra ID housekeeping process.
Regular reviews help keep the directory organised, reduce administrative overhead, and prevent outdated groups from accumulating over time!
