It is a crucial requirement for administrators to regularly monitor and track Active Directory account activity for Microsoft 365 to maintain security, compliance, and operational control. This can include retrieving a list of all users from a tenant based on filter conditions like, “job title” or “department” or it could be to prevent malicious users causing a data breach. In this case it is essential to always be looking for any activity that deviates from normal as this could be indicative of an attack. Users with sufficient administrative rights can create any number of user accounts and these accounts can then be used to manipulate or steal sensitive data.
While the Microsoft 365 Admin Center or Entra portal can provide a list of all users, these options currently lack the feature to apply filters based on specific requirements.
So, if you need a list of all users belonging to the Finance department, you would need to export all users to a spreadsheet and apply a filter on the “Department” column there. This is quite laborious, especially when dealing with many users.
This article will guide you on how to retrieve users based on specific filter conditions firstly using PowerShell and then looking at a more straightforward approach using Lepide Auditor.
Using PowerShell
To retrieve Microsoft Entra ID users based on specific filter conditions, you can use the Microsoft Graph PowerShell module. First, ensure that the Microsoft.Graph module is installed and active by running the following:
Install-Module Microsoft.Graph
Import-Module Microsoft.Graph
Connect-MgGraph
Once connected to Microsoft Graph, you can use various cmdlets to find and manage Entra ID users:
To display a full list of user accounts:
Get-MgUser
To retrieve all users whose job title starts with ‘Accounts, such as Accounts Manager and Accounts Assistant:
Get-MgUser -Filter "startsWith(jobTitle, 'Accounts')"
To retrieve all users whose department is Finance:
Get-MgUser -Filter "department eq 'Finance'"
To get all users whose country equals UK:
Get-AzureADUser -Filter "Country eq 'UK'"
How Lepide Auditor Helps
Generating a list of user accounts in this way by running PowerShell cmdlets can be complex and time consuming and requires a good knowledge of PowerShell scripting. An alternative solution is to use Lepide Auditor for Entra ID and run the All Users Report.
To run this report:
- From the Web Console Home Screen, select Lepide Auditor
- From the list of reports, expand Azure AD, then expand State in Time Reports
- Select the All Users Report
- Apply any filters as required
- Click Generate Report
