Empty Entra ID groups – The easy way

In this post we will describe an easy and convenient way to empty an Entra ID group from its members.

Introduction

Managing Entra ID (formerly Azure AD) groups efficiently is a common challenge for IT administrators. Whether you’re reorganizing your directory structure, cleaning up test environments, or performing routine maintenance, emptying group memberships quickly and accurately is essential.

In this guide, we’ll show you how to automate the process of removing all members from an Entra ID group using PowerShell, saving you time and reducing the risk of manual errors.

The Problem with Manual Group Cleanup

The traditional approach to emptying an Entra ID group involves several manual steps:

1. Navigating to the Azure portal or Entra admin center
2. Locating the specific group
3. Exporting the member list
4. Manually removing members one by one or in batches
5. Verifying all members have been removed

This process is time-consuming, especially for groups with hundreds or thousands of members. It’s also prone to human error and lacks the repeatability needed for environments where this task is performed regularly.

Prerequisites

Before implementing the PowerShell solution, ensure you have the following:

• Microsoft Graph PowerShell SDK installed on your system
• Appropriate permissions in Entra ID
• PowerShell 5.1 or later (PowerShell 7+ recommended)
• The Display Name of the target group

The Script

You can also find the code on my GitHub page here.

# Set the Group Name here
$GroupName = "your-group-name-here"  # Replace with the actual Group Display Name

# Connect to Microsoft Graph (ensure you have the necessary permissions)
Connect-MgGraph

Write-Host "=== Empty Group Members Starting ===" -ForegroundColor Cyan

try {
    # Resolve the group ID from the display name
    Write-Host "Resolving group: $GroupName" -ForegroundColor Cyan
    $group = Get-MgGroup -Filter "displayName eq '$GroupName'" -ErrorAction Stop
    
    if ($null -eq $group) {
        Write-Error "Group '$GroupName' not found."
        return
    }
    
    $GroupID = $group.Id
    Write-Host "Found group ID: $GroupID" -ForegroundColor Green

    # Fetch group members
    Write-Host "Fetching group members..." -ForegroundColor Cyan
    $members = Get-MgGroupMember -GroupId $GroupID -All -ErrorAction Stop
    
    if ($null -eq $members -or $members.Count -eq 0) {
        Write-Host "Group is already empty." -ForegroundColor Green
        return
    }
    
    $totalMembers = $members.Count
    Write-Host "Found $totalMembers members to remove." -ForegroundColor Yellow
    
    $counter = 0
    foreach ($member in $members) {
        $counter++
        $memberId = $member.Id
        $displayName = if ($member.AdditionalProperties.ContainsKey("displayName")) { $member.AdditionalProperties["displayName"] } else { $memberId }
        $type = if ($member.AdditionalProperties.ContainsKey("@odata.type")) { $member.AdditionalProperties["@odata.type"] } else { "Unknown" }
        
        Write-Host "[$counter/$totalMembers] Removing member: $displayName ($type)..." -NoNewline
        
        try {
            Remove-MgGroupMemberByRef -GroupId $GroupID -DirectoryObjectId $memberId -ErrorAction Stop
            Write-Host " [OK]" -ForegroundColor Green
        }
        catch {
            Write-Host " [FAILED]" -ForegroundColor Red
            Write-Host "Error: $($_.Exception.Message)" -ForegroundColor Red
        }
    }
    
    Write-Host "Empty group operation completed." -ForegroundColor Cyan
}
catch {
    Write-Error "Error: $($_.Exception.Message)"
}

Troubleshooting Common Issues

Authentication Failures

If you encounter authentication errors, verify that:

• You have the correct permissions in Entra ID
• Your account has MFA configured if required
• The Microsoft Graph module is up to date

Throttling Errors

Microsoft Graph implements throttling to protect service performance. If you encounter throttling:

• Add delays between batch operations
• Reduce batch sizes
• Implement retry logic with exponential backoff

Permission Denied Errors

Ensure your account has sufficient privileges. Group Administrators can manage groups they own, but Global Administrators or Privileged Role Administrators may be required for certain groups.

Conclusion

Automating the process of emptying Entra ID groups with PowerShell significantly improves efficiency and reduces the potential for errors. The script provided in this guide offers a straightforward, repeatable solution that can be adapted to your specific needs.

By leveraging the Microsoft Graph PowerShell SDK, you ensure your automation is built on a modern, supported platform that will continue to receive updates and improvements from Microsoft.

For more advanced scenarios, consider expanding this script with error handling, logging, and integration with your existing automation workflows.

Other Interesting Posts

• Easy way to remove devices from Entra ID group