Microsoft 365 Offboarding with PowerShell: Check User Group Membership and Remove Group Access

When a staff member leaves the business, one of the most important offboarding steps is removing their access to Microsoft 365 groups. If this step is missed, the user may still have access to email distribution lists, collaboration spaces, security groups, or Microsoft Teams-connected groups.

Using Microsoft Graph PowerShell, you can quickly check which groups a user belongs to and remove them in a controlled way. This is especially useful for IT admins and managed service providers who need a simple and repeatable offboarding process.

In this article, we will cover: how to check which groups a user is a member of; how to remove the user from those groups; a reviewed and improved PowerShell script; key points to check before running it in production.

Why this matters during offboarding

A standard Microsoft 365 offboarding process usually includes: blocking sign-in; resetting the password; converting the mailbox if needed; removing licences; revoking sessions; removing group membership and access.

Group cleanup is often overlooked, but it matters because groups can control access to: SharePoint sites; Teams; shared mailboxes; distribution lists; security-controlled resources; Microsoft 365 apps and services.

If a former user is left in these groups, access may continue longer than intended.

Step 1: Check which groups the user belongs to

The first command is used to list the groups assigned to a user.

Get-MgUserMemberOfAsGroup -UserId user@domain.com -All | Select-Object Id, DisplayName

What this does: This command checks Microsoft Graph for the user's group memberships, returns only group objects, and displays the group ID and group name.

This is a good first step before making any changes, because it gives you a clear view of what the user is currently linked to.

Step 2: Connect to Microsoft Graph

Before making changes, you need to connect to Microsoft Graph with the required permissions.

Connect-MgGraph -Scopes "User.Read.All","Group.Read.All","Group.ReadWrite.All"

This allows the script to: read user details; read group memberships; remove the user from supported groups.

Full script example: Connect-MgGraph -Scopes "User.Read.All","Group.Read.All","Group.ReadWrite.All". $userUpn = "user@domain.com". # Get the user, $user = Get-MgUser -UserId $userUpn -ErrorAction Stop. # Get only group memberships, $groups = Get-MgUserMemberOfAsGroup -UserId $user.Id -All. if (-not $groups) { Write-Host "No group memberships found for $userUpn"; return }. foreach ($group in $groups) { $groupId = $group.Id; $groupName = $group.DisplayName; try { Remove-MgGroupMemberByRef -GroupId $groupId -DirectoryObjectId $user.Id -ErrorAction Stop; Write-Host "Removed from group: $groupName" } catch { Write-Warning "Failed to remove from group: $groupName. $($_.Exception.Message)" } }

Best practice for Microsoft 365 offboarding

Removing a user from groups is only one part of a proper offboarding process. A complete process should also include: blocking sign-in; resetting the password; revoking active sessions; removing licences; forwarding or converting the mailbox if required; removing from groups and Teams; checking shared mailbox permissions; reviewing OneDrive ownership and retention; documenting all actions taken.

A repeatable offboarding process reduces risk and helps maintain compliance.

Final thoughts

PowerShell remains one of the most efficient ways to manage Microsoft 365 offboarding, especially when you need consistency across multiple users. By using Microsoft Graph PowerShell, you can quickly check a user's group memberships and remove access as part of a secure offboarding workflow.

The script above is simple, practical, and easy to adapt for internal IT teams or managed service providers supporting client environments.

If your business manages regular staff changes, it is worth turning steps like this into a standard operating procedure or automation workflow.