Skip to content

user-list-transitivememberof.md

Latest commit

 

History

History
322 lines (234 loc) · 9.91 KB

user-list-transitivememberof.md

File metadata and controls

322 lines (234 loc) · 9.91 KB
title List a user's memberships (direct and transitive)
description Get groups, directory roles, and administrative units that the user is a member of through either direct or transitive membership.
author yuhko-msft
ms.reviewer mbhargav, khotzteam, aadgroupssg
ms.localizationpriority medium
ms.subservice entra-users
doc_type apiPageType
ms.date 10/22/2024

List a user's memberships (direct and transitive)

Namespace: microsoft.graph

Get groups, directory roles, and administrative units that the user is a member of through either direct or transitive membership.

[!INCLUDE national-cloud-support]

Permissions

Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.

Permissions for the signed-in user's memberships

[!INCLUDE permissions-table]

Permissions for another user's memberships

[!INCLUDE permissions-table]

[!INCLUDE limited-info]

Tip

  • Calling the /me/transitiveMemberOf endpoint requires a signed-in user and therefore a delegated permission. Application permissions are not supported when you use the /me/transitiveMemberOf endpoint.
  • To list the members of a group with hidden membership, the Member.Read.Hidden permission is required.

HTTP request

GET /me/transitiveMemberOf

[!INCLUDE me-apis-sign-in-note]

GET /users/{id | userPrincipalName}/transitiveMemberOf

Optional query parameters

This method supports the $filter, $count, $select, $search, $top OData query parameters to help customize the response.

  • OData cast is also enabled. For example, you can cast to get just the transitive membership in groups.
  • $search is supported on the displayName property only.
  • The default and maximum page size is 100 and 999 objects respectively.
  • The use of query parameters with this API is supported only with advanced query parameters. For more information, see Advanced query capabilities on directory objects.

Request headers

Header Value
Authorization Bearer {token}. Required. Learn more about authentication and authorization.
ConsistencyLevel eventual. This header and $count are required when using the $search, $filter, $orderby, or OData cast query parameters. It uses an index that might not be up-to-date with recent changes to the object.

Request body

Don't supply a request body for this method.

Response

If successful, this method returns a 200 OK response code and collection of directoryObject objects in the response body.

Examples

Example 1: Get groups, directory roles, and administrative units that the user is a member of

Request

The following example shows a request.

HTTP

GET https://graph.microsoft.com/v1.0/users/6e7b768e-07e2-4810-8459-485f84f8f204/transitiveMemberOf

C#

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Go

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Java

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

JavaScript

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PHP

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PowerShell

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Python

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Response

The following example shows the response.

Note: The response object shown here might be shortened for readability.

HTTP/1.1 200 OK
Content-type: application/json

{
  "@odata.context":"https://graph.microsoft.com/v1.0/$metadata#directoryObjects",
  "value":[
    {
      "@odata.type":"#microsoft.graph.group",
      "displayName":"All_Contoso_Licensing",
      "mailEnabled":true,
      "mailNickname":"ContosoMailNickName",
      "securityEnabled":true
    }
  ]
}

Example 2: Get only a count of transitive membership in groups, directory roles, and administrative units

Request

The following example shows a request.

GET https://graph.microsoft.com/v1.0/users/{id}/transitiveMemberOf/$count
ConsistencyLevel: eventual

Response

The following example shows the response.

HTTP/1.1 200 OK
Content-type: text/plain

893

Example 3: Use OData cast to get only a count of transitive membership in groups

Request

The following example shows a request.

GET https://graph.microsoft.com/v1.0/users/{id}/transitiveMemberOf/microsoft.graph.group/$count
ConsistencyLevel: eventual

Response

The following example shows the response.

HTTP/1.1 200 OK
Content-type: text/plain

588

Example 4: Use $search and OData cast to get transitive membership in groups with display names that contain the letters 'tier' including a count of returned objects

Request

The following example shows a request.

GET https://graph.microsoft.com/v1.0/users/{id}/transitiveMemberOf/microsoft.graph.group?$count=true&$orderby=displayName&$search="displayName:tier"&$select=displayName,id
ConsistencyLevel: eventual

Response

The following example shows the response.

Note: The response object shown here might be shortened for readability.

HTTP/1.1 200 OK
Content-type: application/json

{
  "@odata.context":"https://graph.microsoft.com/v1.0/$metadata#groups(displayName,id)",
  "@odata.count":7,
  "value":[
    {
      "displayName":"Contoso-tier Query Notification",
      "id":"11111111-2222-3333-4444-555555555555"
    }
  ]
}

Example 5: Use $filter and OData cast to get transitive membership in groups with a display name that starts with 'a' including a count of returned objects

Request

The following example shows a request.

GET https://graph.microsoft.com/v1.0/users/{id}/transitiveMemberOf/microsoft.graph.group?$count=true&$orderby=displayName&$filter=startswith(displayName, 'a')
ConsistencyLevel: eventual

Response

The following example shows the response.

Note: The response object shown here might be shortened for readability.

HTTP/1.1 200 OK
Content-type: application/json

{
  "@odata.context":"https://graph.microsoft.com/v1.0/$metadata#groups",
  "@odata.count":76,
  "value":[
    {
      "displayName":"AAD Contoso Users",
      "mail":"AADContoso_Users@contoso.com",
      "mailEnabled":true,
      "mailNickname":"AADContoso_Users",
      "securityEnabled":true
    }
  ]
}