List group transitive members
6/30/2021
8 minutes to read
In this article
Namespace: microsoft.graph
Get a list of the group's members. A group can have users, devices, organizational contacts, and other groups as members. This operation is transitive and returns a flat list of all nested members.
Permissions
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see Permissions .
Permission type
Permissions (from least to most privileged)
Delegated (work or school account)
GroupMember.Read.All, Group.Read.All, GroupMember.ReadWrite.All, Group.ReadWrite.All, Directory.Read.All, Directory.AccessAsUser.All
Delegated (personal Microsoft account)
Not supported.
Application
GroupMember.Read.All, Group.Read.All, GroupMember.ReadWrite.All, Group.ReadWrite.All, Directory.Read.All
Note: To list the members of a hidden membership group, the Member.Read.Hidden permission is required.
When an application queries a relationship that returns a directoryObject type collection, if it does not have permission to read a certain derived type (like device), members of that type are returned but with limited information. With this behaviour applications can request the least privileged permissions they need, rather than rely on the set of Directory. * permissions. For details, see Limited information returned for inaccessible member objects .
HTTP request
GET /groups/{id}/transitiveMembers
Optional query parameters
This method supports the OData query parameters to help customize the response, including $search, $count, and $filter. You can use $search on the displayName and description properties. When items are added or updated for this resource, they are specially indexed for use with the $count and $search query parameters. There can be a slight delay between when an item is added or updated and when it is available in the index.
To filter the results on the OData type, such as microsoft.graph.user or microsoft.graph.group, you must use the advanced query parameters . That is, the ConsistencyLevel header set to eventual and the $count=true query string.
Name
Description
Authorization
Bearer {token}. Required.
ConsistencyLevel
eventual. This header and $count are required when using the $search, $filter, $orderby, or OData cast query parameters. It uses an index that might not be up-to-date with recent changes to the object.
Request body
Do not supply a request body for this method.
Response
If successful, this method returns a 200 OK response code and a collection of directoryObject objects in the response body.
Examples
Example 1: Get the transitive membership of a group
Request
The following is an example of the request.
GET https://graph.microsoft.com/v1.0/groups/{id}/transitiveMembers
GraphServiceClient graphClient = new GraphServiceClient( authProvider );
var transitiveMembers = await graphClient.Groups["{group-id}"].TransitiveMembers
.Request()
.GetAsync();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
const options = {
authProvider,
};
const client = Client.init(options);
let transitiveMembers = await client.api('/groups/{id}/transitiveMembers')
.get();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
MSHTTPClient *httpClient = [MSClientFactory createHTTPClientWithAuthenticationProvider:authenticationProvider];
NSString *MSGraphBaseURL = @"https://graph.microsoft.com/v1.0/";
NSMutableURLRequest *urlRequest = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:[MSGraphBaseURL stringByAppendingString:@"/groups/{id}/transitiveMembers"]]];
[urlRequest setHTTPMethod:@"GET"];
MSURLSessionDataTask *meDataTask = [httpClient dataTaskWithRequest:urlRequest
completionHandler: ^(NSData *data, NSURLResponse *response, NSError *nserror) {
NSError *jsonError = nil;
MSCollection *collection = [[MSCollection alloc] initWithData:data error:&jsonError];
MSGraphDirectoryObject *directoryObject = [[MSGraphDirectoryObject alloc] initWithDictionary:[[collection value] objectAtIndex: 0] error:&nserror];
}];
[meDataTask execute];
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();
DirectoryObjectCollectionWithReferencesPage transitiveMembers = graphClient.groups("{id}").transitiveMembers()
.buildRequest()
.get();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
Response
The following is an example of the response.
Note : The response object shown here might be shortened for readability.
HTTP/1.1 200 OK
Content-type: application/json
{
"value": [
{
"@odata.type": "#microsoft.graph.user",
"id": "11111111-2222-3333-4444-555555555555",
"mail": "group1@contoso.com"
}
]
}
Example 2: Get only a count of transitive membership
Request
The following is an example of the request.
GET https://graph.microsoft.com/v1.0/groups/{id}/transitiveMembers/$count
ConsistencyLevel: eventual
GraphServiceClient graphClient = new GraphServiceClient( authProvider );
var int32 = await graphClient.Groups["{group-id}"].TransitiveMembers.$count
.Request()
.Header("ConsistencyLevel","eventual")
.GetAsync();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
const options = {
authProvider,
};
const client = Client.init(options);
let int32 = await client.api('/groups/{id}/transitiveMembers/$count')
.header('ConsistencyLevel','eventual')
.get();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
MSHTTPClient *httpClient = [MSClientFactory createHTTPClientWithAuthenticationProvider:authenticationProvider];
NSString *MSGraphBaseURL = @"https://graph.microsoft.com/v1.0/";
NSMutableURLRequest *urlRequest = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:[MSGraphBaseURL stringByAppendingString:@"/groups/{id}/transitiveMembers/$count"]]];
[urlRequest setHTTPMethod:@"GET"];
[urlRequest setValue:@"eventual" forHTTPHeaderField:@"ConsistencyLevel"];
MSURLSessionDataTask *meDataTask = [httpClient dataTaskWithRequest:urlRequest
completionHandler: ^(NSData *data, NSURLResponse *response, NSError *nserror) {
MSGraphInt32 *int32 = [[MSGraphInt32 alloc] initWithData:data error:&nserror];
}];
[meDataTask execute];
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();
LinkedList<Option> requestOptions = new LinkedList<Option>();
requestOptions.add(new HeaderOption("ConsistencyLevel", "eventual"));
int int32 = graphClient.groups("{id}").transitiveMembers().count()
.buildRequest( requestOptions )
.get();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
Response
The following is an example of the response.
Note: The response object shown here might be shortened for readability.
HTTP/1.1 200 OK
Content-type: text/plain
893
Example 3: Use the microsoft.graph.group OData cast to get only members that are groups
Request
The following is an example of the request.
GET https://graph.microsoft.com/v1.0/groups/{id}/transitivemembers/microsoft.graph.group?$count=true
ConsistencyLevel: eventual
GraphServiceClient graphClient = new GraphServiceClient( authProvider );
var group = await graphClient.Groups["{group-id}"].TransitiveMembers
.Request()
.Header("ConsistencyLevel","eventual")
.GetAsync();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
const options = {
authProvider,
};
const client = Client.init(options);
let group = await client.api('/groups/{id}/transitivemembers/microsoft.graph.group')
.header('ConsistencyLevel','eventual')
.get();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
MSHTTPClient *httpClient = [MSClientFactory createHTTPClientWithAuthenticationProvider:authenticationProvider];
NSString *MSGraphBaseURL = @"https://graph.microsoft.com/v1.0/";
NSMutableURLRequest *urlRequest = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:[MSGraphBaseURL stringByAppendingString:@"/groups/{id}/transitivemembers/microsoft.graph.group?$count=true"]]];
[urlRequest setHTTPMethod:@"GET"];
[urlRequest setValue:@"eventual" forHTTPHeaderField:@"ConsistencyLevel"];
MSURLSessionDataTask *meDataTask = [httpClient dataTaskWithRequest:urlRequest
completionHandler: ^(NSData *data, NSURLResponse *response, NSError *nserror) {
NSError *jsonError = nil;
MSCollection *collection = [[MSCollection alloc] initWithData:data error:&jsonError];
MSGraphGroup *group = [[MSGraphGroup alloc] initWithDictionary:[[collection value] objectAtIndex: 0] error:&nserror];
}];
[meDataTask execute];
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();
LinkedList<Option> requestOptions = new LinkedList<Option>();
requestOptions.add(new HeaderOption("ConsistencyLevel", "eventual"));
GroupCollectionPage group = graphClient.groups("{id}").transitiveMembers().microsoft.graph.group()
.buildRequest( requestOptions )
.get();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
Response
The following is an example of the response.
Note: The response object shown here might be shortened for readability.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#groups",
"@odata.count": 2,
"value": [
{
"@odata.id": "https://graph.microsoft.com/v2/927c6607-8060-4f4a-a5f8-34964ac78d70/directoryObjects/4d0ef681-e88f-42a3-a2db-e6bf1e249e10/Microsoft.DirectoryServices.Group",
"id": "4d0ef681-e88f-42a3-a2db-e6bf1e249e10",
"organizationId": "927c6607-8060-4f4a-a5f8-34964ac78d70",
"description": null,
"displayName": "Executives",
"groupTypes": [],
"mail": "Executives@contoso.com",
"mailEnabled": true,
"mailNickname": "Executives",
},
{
"@odata.id": "https://graph.microsoft.com/v2/927c6607-8060-4f4a-a5f8-34964ac78d70/directoryObjects/d9fb0c47-c783-40a1-bce1-53b52ada51fc/Microsoft.DirectoryServices.Group",
"id": "d9fb0c47-c783-40a1-bce1-53b52ada51fc",
"organizationId": "927c6607-8060-4f4a-a5f8-34964ac78d70",
"displayName": "Project Falcon",
"groupTypes": [],
"mail": "Falcon@contoso.com",
"mailEnabled": true,
"mailNickname": "Falcon",
}
]
}
Example 4: Use OData cast and $search to get membership in groups with display names that contain the letters 'tier' including a count of returned objects
Request
The following is an example of the request.
GET https://graph.microsoft.com/v1.0/groups/{id}/transitiveMembers/microsoft.graph.user?$count=true&$orderBy=displayName&$search="displayName:tier"&$select=displayName,id
ConsistencyLevel: eventual
GraphServiceClient graphClient = new GraphServiceClient( authProvider );
var user = await graphClient.Groups["{group-id}"].TransitiveMembers
.Request()
.Header("ConsistencyLevel","eventual")
.Search("displayName:tier")
.Select("displayName,id")
.OrderBy("displayName")
.GetAsync();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
const options = {
authProvider,
};
const client = Client.init(options);
let user = await client.api('/groups/{id}/transitiveMembers/microsoft.graph.user')
.header('ConsistencyLevel','eventual')
.search('displayName:tier')
.select('displayName,id')
.orderby('displayName')
.get();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
MSHTTPClient *httpClient = [MSClientFactory createHTTPClientWithAuthenticationProvider:authenticationProvider];
NSString *MSGraphBaseURL = @"https://graph.microsoft.com/v1.0/";
NSMutableURLRequest *urlRequest = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:[MSGraphBaseURL stringByAppendingString:@"/groups/{id}/transitiveMembers/microsoft.graph.user?$count=true&$orderBy=displayName&$search=%22displayName:tier%22&$select=displayName,id"]]];
[urlRequest setHTTPMethod:@"GET"];
[urlRequest setValue:@"eventual" forHTTPHeaderField:@"ConsistencyLevel"];
MSURLSessionDataTask *meDataTask = [httpClient dataTaskWithRequest:urlRequest
completionHandler: ^(NSData *data, NSURLResponse *response, NSError *nserror) {
NSError *jsonError = nil;
MSCollection *collection = [[MSCollection alloc] initWithData:data error:&jsonError];
MSGraphUser *user = [[MSGraphUser alloc] initWithDictionary:[[collection value] objectAtIndex: 0] error:&nserror];
}];
[meDataTask execute];
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();
LinkedList<Option> requestOptions = new LinkedList<Option>();
requestOptions.add(new HeaderOption("ConsistencyLevel", "eventual"));
requestOptions.add(new QueryOption("$search", "displayName:tier"));
UserCollectionPage user = graphClient.groups("{id}").transitiveMembers().microsoft.graph.user()
.buildRequest( requestOptions )
.select("displayName,id")
.orderBy("displayName")
.get();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
Response
The following is an example of the response.
Note: The response object shown here might be shortened for readability.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#users(displayName,id)",
"@odata.count":7,
"value":[
{
"displayName":"Joseph Price",
"id":"11111111-2222-3333-4444-555555555555"
}
]
}
Example 5: Use OData cast and $filter to get user membership in groups with a display name that starts with 'A' including a count of returned objects
Request
The following is an example of the request.
GET https://graph.microsoft.com/v1.0/groups/{id}/transitiveMembers/microsoft.graph.user?$count=true&$orderBy=displayName&$filter=startswith(displayName, 'a')
ConsistencyLevel: eventual
GraphServiceClient graphClient = new GraphServiceClient( authProvider );
var groups = await graphClient.Groups
.Request()
.Header("ConsistencyLevel","eventual")
.Filter("startswith(displayName, 'a')")
.OrderBy("displayName")
.Top(1)
.GetAsync();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
const options = {
authProvider,
};
const client = Client.init(options);
let groups = await client.api('/groups')
.header('ConsistencyLevel','eventual')
.filter('startswith(displayName, \'a\')')
.orderby('displayName')
.top(1)
.get();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
MSHTTPClient *httpClient = [MSClientFactory createHTTPClientWithAuthenticationProvider:authenticationProvider];
NSString *MSGraphBaseURL = @"https://graph.microsoft.com/v1.0/";
NSMutableURLRequest *urlRequest = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:[MSGraphBaseURL stringByAppendingString:@"/groups?$filter=startswith(displayName,%20'a')&$count=true&$top=1&$orderby=displayName"]]];
[urlRequest setHTTPMethod:@"GET"];
[urlRequest setValue:@"eventual" forHTTPHeaderField:@"ConsistencyLevel"];
MSURLSessionDataTask *meDataTask = [httpClient dataTaskWithRequest:urlRequest
completionHandler: ^(NSData *data, NSURLResponse *response, NSError *nserror) {
NSError *jsonError = nil;
MSCollection *collection = [[MSCollection alloc] initWithData:data error:&jsonError];
MSGraphGroup *group = [[MSGraphGroup alloc] initWithDictionary:[[collection value] objectAtIndex: 0] error:&nserror];
}];
[meDataTask execute];
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();
LinkedList<Option> requestOptions = new LinkedList<Option>();
requestOptions.add(new HeaderOption("ConsistencyLevel", "eventual"));
GroupCollectionPage groups = graphClient.groups()
.buildRequest( requestOptions )
.filter("startswith(displayName, 'a')")
.orderBy("displayName")
.top(1)
.get();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
Response
The following is an example of the response.
Note: The response object shown here might be shortened for readability.
HTTP/1.1 200 OK
Content-type: application/json
{
"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#users",
"@odata.count":76,
"value":[
{
"displayName":"AAD Contoso Users",
"mail":"AADContoso_Users@contoso.com"
}
]
}
