The Get-MgGroup command comes with a filtering function just like, e.g., Get-ADGroup.
But if you’re expecting the power of the Get-ADGroup LdapFilter switch or the PowerShell expression language Filter switch, then you’re in for a sad surprise…
The Get-MgGroup filter uses OData v3, which is overly complex and lacks lots of functionality.
Unfortunately, in most cases, your better option is to retrieve all group objects and perform the filtering locally.
The below sections will demonstrate some uses of the Get-MgGroup Filter options.
If you prefer a simple GUI instead of complex PowerShell scripts, have a look at Easy365Manager:
Easy365Manager is a snap-in to Active Directory Users & Computers that consolidates Office 365 and Active Directory management.
With Easy365Manager, you can perform all daily Office 365 management directly from AD. This includes tasks typically requiring PowerShell, like the configuration of calendar permissions, as seen in the above example.
Review the complete Easy365Manager feature list here.
Download a fully functional 30-day trial here.
Get-MgGroup Filter Operators
The Filter switch of the Get-MgGroup command builds on oData v3.0 filtering.
This is contrary to the PowerShell expression language filter used by Get-ADGroup -Filter, which again is different from the very basic Get-MsolGroup -SearchString filter option.
Sure would be nice if the various development teams at Microsoft could coordinate their efforts… 😏
The following details the basic operators available to Get-MgGroup filtering:
| Operator | Meaning | Sample expression |
|---|---|---|
| eq | Equal to | DisplayName eq ‘Tycho Brahe’ |
| and | And | Country eq ‘Germany’ and Department eq ‘Marketing’ |
| or | Or | Country eq ‘Germany’ or Country eq ‘France’ |
Notice that the Like filter is unavailable – it’s impossible to search substrings in MS Graph group attributes, which severely limits the use cases. The same goes for the Not filter and many more.
The only type of wildcard search available is the ‘startswith’ filter.
Additionally, it’s possible to search the values of multivalue attributes using the ‘any’ filter.
However, a significant limitation of this is the inability to search complex object-type attributes like ‘AssignedLicenses.’
Get-MgGroup Filter Examples
Below you’ll find some basic examples of the Get-MgGroup filter syntax.
Get-MgGroup -Filter "DisplayName eq 'E5_Licenses'"Get-MgGroup -Filter "DisplayName eq 'E3_Licenses' or DisplayName eq 'E5_Licenses'"Get-MgGroup -Filter "startswith(displayName,'US.')"Get-MgGroup -Filter "proxyAddresses/any(p:startswith(p,'smtp:sales'))"But as mentioned at the beginning of the article:
The use cases of the Get-MgGroup Filter parameter are very limited. In most cases, you’re forced to retrieve all groups and perform the filtering locally, using the PowerShell expression language filter, e.g.:
Get-MgGroup -All | Where-Object {$_.DisplayName -like "*marketing*"}Get-MgGroup -Property AssignedLicenses,DisplayName -All | Where-Object {$_.AssignedLicenses.SkuId -eq "c42b9cae-ea4f-4ab7-9717-81576235ccac"} | ft DisplayNameAlthough this approach may perform badly in large environments, it offers a lot more options and flexibility.