Export Office 365 Distribution Group Members Using PowerShell

Office 365 Distribution Groups (aka Distribution List) are used to send emails or meeting request to list of people (both internal and external users), without having to add the email address individually each time. Distribution Groups are suitable when you need to broadcast information to a group of people, such as “People in the sales department” or “All people at your company”. Also, admins can add bulk users to distribution group based on their requirements.

Finding out who is members of which Distribution Group is always a tedious task. You can view Distribution Group members through Microsoft 365 Admin Center, but it is per user base. So, you need to click each group to view its membership which is time-consuming. Fear not! Your friend, PowerShell is here for the rescue. You can use PowerShell commands to export distribution list members to csv.

If your distribution group has dynamic members (users automatically assigned to a group based on some predefined conditions), you need to use different cmdlets to get dynamic distribution group members.

We have written a PowerShell script to export Distribution List members to CSV along with most required attributes like Group DisplayName, Group Primary SMTP Address, Group Alias, Group Type, Group Owner (Managed By), Members Count, Members, Member Email, Member’s Type, and Users allowed to send email to the Distribution Group.

Exchange Online PowerShell cmdlet Get-DistributionGroup used to list all distribution group available in the tenant and Get-DistributionGroupMember used to list group members. Export-CSV cmdlet used to export the report to CSV file. A group can have many members and exporting them in a single line is not an aesthetic one.

To understand your Distribution Group membership better, our script will provide two output files.

• Distribution Group Summary Report
• Detailed Distribution Group Membership Report

Download Script: GetDistributionGroupMembers

Script Highlights:

• The script uses modern authentication to connect to Exchange Online.
• Allows you to filter the report result based on group size(i.e., Members count).
• The script can be executed with MFA enabled account too.
• You can choose to either “Export Members of all Distribution Lists” or pass an input file to “Export Members of Specific Distribution List”.
• You can filter the output based on whether the group accepts message from external senders or not.
• Exports the list of allowed senders to a Distribution List.
• Output can be filtered to list Empty group. i.e., Distribution Group without members
• Exports the report result to CSV.
• You can get members count based on Member Type such as User mailbox, Group mailbox, Shared mailbox, Contact, etc.
• Automatically installs the EXO V2 (if not installed already) upon your confirmation.
• The script is scheduler friendly. i.e., credentials can be passed as parameter instead of saving inside the script.
• Above all, script exports output in nicely formatted 2 CSV files. One with detailed information and another with summary information.

Office 365 Distribution Group Summary Report:

Distribution Group summary report has following attributes.

• Group Display Name,
• Primary SMTP Address,
• Group Alias,
• Group Type,
• Group Owner (Managed By),
• Group Members Count,
• Members Count by Recipient Type,
• Allows External users
• Allowed Senders (I.e., Authorized Senders to a Distribution Group)
• Hidden From Exchange Address List (Optional)
• Description (Optional)
• Creation Time (Optional)
• DirSynEnabled (Optional)
• Member Join Restriction (Optional)
• Member Depart Restriction (Optional)

Detailed Office 365 Distribution Group Membership Report:

Detailed Office 365 Distribution Group membership report has following attributes:

• Group Display Name,
• Primary SMTP Address,
• Group Alias,
• Group Members Count,
• Group Members,
• Member Primary SMTP Address
• Member Recipient Type

Export Distribution List Members to CSV:

To export all Office 365 Distribution Lists and members report, execute the script as follows

The above format will work for both MFA and non-MFA accounts.

This script has many built-in parameters to filter/customize the report based on your requirement. We have listed some of the primary uses cases below.

• Gets members for a single/list of Distribution Group.
• Gets members for Distribution Group that has more than ‘N’ members.
• To get empty Distribution Group.
• Exports Distribution Group that allows external users to send message.
• Reports who are authorized to send email to a Distribution List.
• Using multiple parameters, you can get more granular report.
• Script can be executed with MFA enabled account.
• Script can be scheduled by explicitly passing credential.
• You can add additional attributes to export file.

Let’s check the use cases in detail.

You can use –GroupNamesFile param to get members of a Distribution Group from the input list called “DistributionList.txt” and exports all membership into CSV.

To get members of specific Distribution List, pass an input file with a Display Name/ Alias/ Distinguished Name/ Canonical DN/ Email Address or GUID of groups.

The GroupNamesFile must follow the format below: Group identity separated by new line without header.

To filter result based on group members count, you can use –MinGroupMembersCount param. i.e., You can get groups that have more than the specified number of members.

Above script reports all Distribution Lists that has more than 50 members.

To get an empty Distribution Group (ie, Distribution Group without members), execute the script with -IsEmpty param.

Using this filter, you can delete unused Distribution List available in your tenant.

This value is retrieved from “RequireSenderAuthenticationEnabled” attribute. It allows you to restrict who can send emails to an Distribution List.

Using –ExternalSendersBlocked Param, you can filter the result based on the delivery option. I.e., you can get list of Distribution groups that allows/denies external users to send a message to that group.

To list Distribution Groups that allows external users to send message to that group, execute a script with –ExternalSendersBlocked $false

To list Distribution Groups that doesn’t allow external users to send message to that group, execute a script with –ExternalSendersBlocked $true

Getting Office 365 Distribution list’s authorized senders is a bit tricky as authorized senders are retrieved by correlating multiple attributes. You can get allowed senders from Get-DistributionGroup cmdlet, and the attributes are,

1. AcceptMessagesOnlyFromSendersOrMembers – Lists allowed senders

2. RequireSenderAuthenticationEnabled – This restrict senders who can send email to a Distribution group, i.e., whether a Distribution Group allows external senders or allows internal senders alone.

How to get allowed senders?

• If the allowed senders’ list has values, group members will receive messages only from those senders and reject messages from everyone else.
• When allowed senders list is empty, group members will receive messages from everyone based on ‘RequireSenderAuthenticationEnabled.’

To make it simple, our ‘Export Distribution List members’ script exports Distribution Group along with authorized senders.

You can use multiple filters together, to get more granular report. For example, you can get members for a list Distribution Group that has more than 50 members

You can schedule this script in task scheduler by explicitly mentioning the credential.

To know more about scheduling Powershell script, refer our blog: Schedule PowerShell script using Task Scheduler.

To add following attributes to Distribution Group members report, uncomment the comment section in the line 110 and 112.

• HiddenFromAddressList (HiddenFromAddressListsEnabled) – Hide group from Global Address List(GAL).
• Description – Short information about group.
• CreationTime (WhenCreated) – Group creation time.
• DirSyncEnabled (IsDirSynced) – Whether the group has directory sync enabled or not.
• JoinGroupWithoutApproval (MemberJoinRestriction) – Shows whether owner approval is required to join a group.
  • Open – Anyone can join group without being approved by the group owner.
  • Close – Members can be added only by the group owner.
• LeaveGroupWithoutRestriction (MemberDepartRestriction) – Shows whether the group is open to leave.
  • Open – Anyone can leave group without being approved by the group owner.
  • Closed – Members can be removed only by the group owner.

To get more detailed group reports based on

• Group types
  • Security group
  • Distribution group
  • Mail-enabled security group
  • Microsoft 365 group
  • Dynamic distribution group
• Group membership
  • Direct members
  • Nested group members
  • Hidden membership
  • External members
• Group creation source
  • Groups created via Teams
  • Groups created via SharePoint Online
  • Groups created via Yammer
• Group member changes
• Groups usage
• Inactive groups based on Last activity date

you can take a look at AdminDroid Microsoft 365 reporting and auditing tool.

Additionally, AdminDroid provides 1500+ pre-built reports and 20 smart visually appealing dashboards to know about your Office 365 environment at a glance. This tool provides reports on Office 365 reporting, auditing, analytics, usage statistics, security & compliance, etc.

Besides, AdminDroid provides over 100+ reports and a handful of dashboards completely for free. It includes reports on Users, Licenses, Groups, Group Members, Devices, Login Activities, Password Changes, License Changes, and more. The free edition doesn’t have any restrictions in reporting functionalities such as customization, scheduling, and exporting. For your Azure AD reporting and auditing needs, you can download Free Office 365 reporting tool by AdminDroid and see how it helps for you.

If you have any queries regarding script, reach us through the comment section.