How to figure out what M365 or AD groups actually do
Microsoft lacks built-in reports showing what specific permissions or resources a group manages, forcing administrators to manually query every underlying file share, application, and service. This makes it impossible to determine if groups are actually needed or safe to delete without risking system disruptions.
Core Friction Pattern
Analysis of 3 peer accounts across online developer and community forums reveals that “How to figure out what M365 or AD groups actually do” repeatedly surfaces due to edge-case mismatches between standard defaults and real-world environments. Standard troubleshooting frequently falls short, compelling practitioners to develop custom workarounds.
+3 alternative community-tested workarounds cataloged below.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
How to figure out what M365 or AD groups actually do
- 1Building a custom inventory from Microsoft Graph covering owners, members, permissions, last activity, SharePoint association, and creation date, then checking audit logs.Did this help you?
- 2Manually checking system descriptions, file shares, and ACL permissionsDid this help you?
- 3Searching through Git repositories and M365 configurations for hitsDid this help you?
- 4Relying on log collectors and group membership change auditingDid this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“They wanted to know how would i cleanup messy AD environment and figure out which AD groups are safe to delete, without absolutely no disruption to anything”source ↗
“I was hoping there was some Powershell command, or menu somewhere, that basically tells me "Group A manages permissions for SharePoint Site B and C, Policy D" and so on. But I literally can't find anything at all.”source ↗
“How have you dealt with sorting through a big list of Groups in M365 and finding out if they're actually needed?”source ↗
“I'm surprised Microsoft doesn't have these kind of reports available”source ↗
“To understand what groups are in use, you actually need to query the services, File shares, applications etc to know what groups are in use. This is not an AD question at all.”source ↗