Managing group memberships is an ongoing responsibility for Microsoft 365 administrators. As organizations grow, users are continuously added to groups to support collaboration, application access, licensing, and administrative tasks. At the same time, user accounts may be disabled for various operational or security reasons. Employees may leave the organization, contractors may finish their engagement, or accounts may be temporarily disabled because of investigations or security incidents.
One thing many administrators overlook is that disabling a user account doesn’t automatically remove it from the groups it belongs to. Although the account can no longer sign in, it continues to appear as a member until someone removes it manually. Over time, these inactive memberships accumulate, making group management more difficult.
Why You Must Audit Disabled Users in M365 Groups
Leaving disabled accounts inside Microsoft 365 Groups, Security Groups, or Distribution Lists creates hidden vulnerabilities and operational inefficiencies.
- Disabled users might still occupy owner roles. If their account is ever compromised or re-enabled by mistake, they instantly regain access to sensitive shared files, emails, and SharePoint sites.
- While disabled users do not always consume an active license, lingering object metadata can complicate true-up audits and user lifecycle management.
- Active team members often waste time tagging departed employees in Microsoft Teams channels or sending emails to dead mailboxes.
- Many regulatory frameworks require strict “least privilege” access controls. Retaining inactive identities in secure groups can trigger compliance audit failures.
Let’s see what are the ways to identify groups containing disabled users in hybrid environments.
Method 1: Check Groups With Disabled Users Using Microsoft Entra Admin Center
If you only need to verify a few groups, you can do so directly from the Microsoft Entra admin center.
- Sign in to the Microsoft Entra admin center.
- Navigate to Groups > All groups.
- Open the group you want to review, then select the Members tab.
- Click on a user’s name to open their profile, where you can check the Account status field to determine whether the account is enabled or disabled.
This approach is suitable for small environments where only a handful of groups need to be checked. However, it quickly becomes impractical in larger organizations. Microsoft Entra doesn’t provide a built-in report or filter that lists groups containing disabled users, so administrators must inspect each group and verify every member individually. If your organization manages hundreds of groups, this manual process can take a considerable amount of time.
That’s where PowerShell becomes a much more efficient option.
Method 2: Find Groups with Disabled Users Using Microsoft Graph PowerShell
Microsoft Graph PowerShell allows you to search every group in your Microsoft 365 tenant and identify disabled user accounts automatically. Run the following script to identify all groups that contain disabled users.
# Connect to Microsoft Graph with required permissions
Connect-MgGraph -Scopes "Group.Read.All", "User.Read.All"
# Fetch all groups in the tenant
Write-Host "Fetching all groups in the tenant..." -ForegroundColor Cyan
$AllGroups = Get-MgGroup -All -Property "id", "displayName", "groupTypes"
$Report = @()
# Loop through each group to audit its members
foreach ($Group in $AllGroups) {
Write-Host "Auditing group: $($Group.DisplayName)" -ForegroundColor Yellow
# Get all members of the current group (fetching only User objects to filter out nested groups)
$Members = Get-MgGroupMember -GroupId $Group.Id -All | Where-Object { $_.AdditionalProperties['@odata.type'] -eq '#microsoft.graph.user' }
foreach ($Member in $Members) {
# Fetch the specific user's status to check if they are disabled
$UserStatus = Get-MgUser -UserId $Member.Id -Property "accountEnabled", "userPrincipalName", "displayName"
# If the user account is disabled, log it into the report
if ($UserStatus.AccountEnabled -eq $false) {
$Report += [PSCustomObject]@{
GroupName = $Group.DisplayName
GroupId = $Group.Id
GroupType = -join $Group.GroupTypes
DisabledUser = $UserStatus.DisplayName
DisabledUserUPN = $UserStatus.UserPrincipalName
DisabledUserId = $UserStatus.Id
}
}
}
}
# Export the results to a CSV file
$OutputPath = "$env:USERPROFILE\Desktop\GroupsWithDisabledUsers.csv"
if ($Report.Count -gt 0) {
$Report | Export-Csv -Path $OutputPath -NoTypeInformation
Write-Host "Audit complete! Groups with disabled users saved to: $OutputPath" -ForegroundColor Green
} else {
Write-Host "Clean audit! No groups found containing disabled users." -ForegroundColor Green
}
# Disconnect session
Disconnect-MgGraphOne important limitation to note is that Microsoft Graph doesn’t currently provide a built-in query that directly returns groups containing disabled users. Because of this, the script must first retrieve every group and then verify each user’s account status individually.
Method 3: Find Groups with Disabled Users in Active Directory
Many organizations operate in a hybrid identity environment where user accounts are managed in on-premises Active Directory and synchronized to Microsoft Entra ID. When an account is disabled in Active Directory, the change synchronizes to Microsoft Entra. However, the user’s Active Directory group memberships remain unchanged until an administrator removes them.
Unlike many other Active Directory searches, this task can’t be accomplished using a single LDAP filter. LDAP filters can locate disabled users or search for groups, but they can’t identify groups based on the enabled or disabled status of their members. To achieve this, you first need to retrieve the disabled users and then enumerate the groups each user belongs to.
The following PowerShell command lists every disabled user together with the Active Directory groups they belong to.
Get-ADUser -Filter 'Enabled -eq $false' | ForEach-Object {
Write-Host "Username: $($_.Name)"
Get-ADPrincipalGroupMembership $_ | ForEach-Object {
Write-Host "Group: $($_.Name)"
}
Write-Host ""
}The output lists every disabled Active Directory user followed by all the groups that user currently belongs to. This works across Active Directory group types and provides a quick way to identify memberships that should be reviewed.
What Should You Do After Identifying Groups With Disabled Users?
Finding groups with disabled users is only the first step. Before removing any memberships, check why the account was disabled. Some accounts may be disabled temporarily, while others may belong to employees who have permanently left the organization.
Once you’ve confirmed that the membership is no longer needed, remove the disabled user from the group. If the disabled account is a group owner, assign ownership to another active user. It’s also a good idea to review privileged groups regularly and document any changes if required for auditing or compliance!
