Microsoft Graph - Get all group members transitive

Question

I currently have Azure AD Groups that contain other Groups as members and the child Groups contain Users. I am looking for a way to get all of the Users in a single query using Microsoft Graph. In this setup the users are transitive members of the parent groups.

I am wondering if there is a way to get all members of a Group including members of any member Groups using Microsoft Graph. I know it is possible to get direct members using https://graph.microsoft.com/v1.0/Groups/{id}/members but I am not aware of a way to list members and transitive members.

My question is very similar to another unanswered question from a while back: Get all members of a group - transitive

UPDATE:

Here is more information on my specific situation. I have a group hierarchy setup in AAD similar to this diagram:

Here, the lines represent membership. This is a small example as there are actually 100+ child groups of each parent group and 5-10 users per child group. I would like to be able to query all users that transitively belong to a parent group without looping through each child group.

I had thought about using $expand=members when querying for direct membership of the parent groups, however, this did not work because the /members route returns a list of DirectoryObjects rather than Group objects. Might there be a way to only return Group object members, or type cast the results?

Answer 1

/transitiveMembers will do the trick for you. It will list all the "users, devices and other groups as members" and all the nested members in transitive way.

Please note that it might not return all the users if there are too many. In that case you will get uri with nextLink to get next batch of results.

Answer 2

You can use /getMemberGroups to return a list of group members:

Check for membership in the specified list of groups. Returns from the list those groups of which the specified group has a direct or transitive membership.

One note on the question you referenced. That question was related to Azure Active Directory Graph, not Microsoft Graph. These are two different APIs. While they have a lot of functional overlap (and Microsoft Graph API will eventually supplant Azure Graph), calls to one are not interchangeable with the other.