Get All Distribution Groups in Microsoft 365 Using PowerShell

• How many distribution groups do we actually need?
• Why do I have 200 distribution groups when we only have 50 employees?

As an admin, if you’ve encountered these questions, you’ve likely noticed that distribution lists tend to accumulate over time. This often results in redundant groups, outdated memberships, and overlooked owners. This situation also increases the security risks in DLs with external users.

Distribution groups reports provide valuable insights into DLs, helping you identify redundant groups, review ownership configurations, and track important changes. Let’s explore how to export distribution groups report to track changes and manage your distribution lists more effectively.

To track Exchange Online distribution lists, you can use the following methods.

1. View distribution groups in Microsoft 365 admin center
2. Export distribution lists using PowerShell

To view and export all the distribution lists in Microsoft 365 admin center, follow the steps below.

1. Sign in to the Microsoft 365 admin center.
2. Navigate to the Teams & groups –> Active teams & groups –> Distribution list tab.
3. Select Export and then choose Export groups in this list to download all the distribution groups in Microsoft 365.

Although the admin center method seems feasible for exporting distribution lists report, it only provides a basic overview of the DLs. As an alternative, you can use the Get-DistributionGroup cmdlet, which shows details like the group’s name, display name, type, and primary SMTP address.

While this approach may work well for smaller environments, if you are a large organization, a more efficient solution becomes essential. Our PowerShell script makes efficient by providing additional details regarding DLs and automatically exporting them into two reports:

1. Distribution Groups Report: Provides common details along with additional insights like group managers, member counts, and so on.
2. Distribution Group Membership Report: Delivers a detailed breakdown of the members for each distribution list.

Download Script: GetDistributionGroups.ps1

Script Highlights:

• Exports distribution groups with allowed / blocked external senders.
• Generates a report that retrieves empty distribution groups.
• Bulk import specific distribution lists and get the report on those specific DLs.
• The script automatically verifies and installs the Exchange Online PowerShell V3 module (if not installed already) upon your confirmation.
• Allows to filter results based on group members count.
• The script can be executed with MFA enabled account too.
• It can be executed with Certificate-based Authentication (CBA) too.
• Exports DL’s members count based on Member Type such as user mailbox, group mailbox, etc.
• The script is scheduler friendly and exports the report result to CSV format.
• This script exports output in 2 CSV files. One with DL details and another with membership details.

Upon execution, the PowerShell script will generate, and export two reports as follows.

This report will export all the distribution lists in your tenant along with key attributes like DisplayName, Primary SMTP Address, Alias, Group Type, Manager, Members Count, Authorized Senders, Members Count By Type, Join Group Without Approval, Leave Group Without Approval, Creation Time, Dir Sync Enabled, Hidden From Address List, External Senders Blocked, and Description.

This report lists all the members in the distribution groups along with attributes like Group members name, Members email address, member type.

1. Download the script.
2. Start the Windows PowerShell.
3. Select any of the methods provided to execute the script.

Method 1: Execute the script with an MFA or non-MFA account.

This will export all the distribution lists into CSV file.

Method 2: Run the script using certificate-based authentication.

To use certificate-based authentication, you must register the app in Entra ID which helps you to connect Exchange Online using certificate. Depending on the requirements, you can use either CA certificates or create self-signed certificates.

You can also schedule this script using Task Scheduler or Azure Automation to periodically export Exchange Online distribution lists report.

The script provides a variety of built-in filtering options tailored to meet different requirements. Here’s how you can make the most of its features:

• List empty distribution groups
• Export distribution lists that have allow external senders
• Get details of specific distribution groups
• View distribution lists with authorized senders
• Get more granular distribution list reports

Empty groups (those without any members) can indicate unused distribution lists that may clutter your environment or cause confusion. Identifying and managing these DLs helps streamline communication and ensure proper group usage.

To detect such groups, execute the script with the –IsEmpty parameter.

This retrieves a report of distribution groups with no members, allowing you to review and take necessary action, such as reassigning, updating, or deleting them.

Allowing external senders means that the DL is configured to accept emails outside of your organization. The ‘RequireSenderAuthenticationEnabled’ attribute provides this value, which determines who can send emails to a distribution list.

While this is beneficial for communicating with clients and partners, it can also increase the risk of receiving unwanted or malicious emails. Monitoring these DLs helps ensure that only trusted external contacts are allowed, thus maintaining a secure and efficient email environment.

By using the –ExternalSendersBlocked parameter in this script, you can filter DLs based on their external email policy.

To get distribution lists that allow external users to send mails to that group, run the format below.

Conversely, to view distribution groups that block external users from sending message to that group, run the below format.

To monitor specific distribution lists in Microsoft 365, use a file named “DistributionList.txt” that contains unique identifiers like display name / email address / alias / GUID of each distribution list you want to track.

Use the –GroupNamesFile param to load that txt file and obtain reports for listed distribution groups. Ensure the file contains one DL identity per line, without including a header. For example,

Authorized senders are individuals or groups allowed to email a distribution list. This is configured using several attributes from the Get-DistributionGroup cmdlet.

Specifically, the AcceptMessagesOnlyFromSendersOrMembers attribute lists safe senders, and RequireSenderAuthenticationEnabled shows whether the DL accepts only internal emails. If the approved senders list has entries, only those can email the list. If it’s empty, the list accepts emails based on its authentication setting.

Monitoring authorized senders is essential for maintaining communication security and preventing unauthorized email distribution. Without proper monitoring, unauthorized users might gain sending privileges. This can result in phishing attacks, data leaks, or spam being sent to your groups.

Our script exports the distribution list with its authorized senders for a straightforward overview.

• Get Distribution Lists with N Number of Members:
  Suppose you need to find the largest distribution list, but manually checking each list would be time-consuming. Instead, use the –MinGroupMembersCount parameter to filter distribution lists with more than a specified number of members.
  
  .\GetDistributionGroups.ps1 -MinGroupMembersCount 20

  1	.\GetDistributionGroups.ps1 -MinGroupMembersCount 20

  
  This format will export the report of all DLs that has more than 20 members.
• Get More Granular Distribution Lists Report:
  You can use multiple filters at the same time to get the more specific report. For example, you can use the following format to get the DLs that has 30 members and allows external sender.
  
  
  .\GetDistributionGroups.ps1 -MinGroupMembersCount 50 -ExternalSendersBlocked $False

  1	.\GetDistributionGroups.ps1 -MinGroupMembersCount 50 -ExternalSendersBlocked $False

  
  If you want to identify which group each user is a member of, you can use the Microsoft 365 users’ direct membership report.

Managing Microsoft 365 distribution lists can be challenging since admin centers provide limited details and PowerShell requires expertise to get the accurate results. Worry not! AdminDroid’s free reporting tool might be exactly what you need.

Unlike traditional PowerShell reporting that requires active execution, AdminDroid provides access to detailed distribution list reports with few clicks. AdminDroid offers an exclusive collection of distribution group-based reports, including

• All Distribution Groups
• Distribution Group Members
• Distribution Group Membership Changes
• Daily Top Distribution Groups by Mails Sent/Received
• Top DLs based on Sending/Receiving Internal Emails
• Top DLs based on Sending/Receiving External Emails
• Active Distribution Groups by Mail Sending/Receiving Frequency
• Monthly/Hourly/Daily Distribution Groups Mail Traffic Stats
• Inactive Distribution Groups by Mails Received
• Inactive distribution Groups by External Mails Received

Comprehensive group management covering all group types along with DLs:

• Security groups
• Mail-enabled security groups
• Microsoft 365 groups
• Dynamic distribution groups

On top of that, the free version unlocks 120+ ready-to-use reports across multiple categories and 10+ interactive dashboards for quick insights. rack everything from direct and nested members to external users, hidden memberships, and group activity patterns – all without spending a dime. The free edition comes with full functionality for report customization, scheduling automated deliveries to your inbox, and flexible export options.

Get reports on users, licenses, devices, login activities, password changes, and more. You can download Free Office 365 reporting tool by AdminDroid and see how it helps you.

For organizations needing even more comprehensive oversight, AdminDroid also provides 1900+ reports and 30 dashboards, covering additional security, compliance, and usage analytics.

Download the free AdminDroid M365 management tool today and transform how you monitor and manage your Microsoft environment.

In summary, this PowerShell script empowers you to take control of your Microsoft 365 distribution groups. Use it to audit group membership changes, flag external access, and simplify cleanup of groups with disabled users. We hope this blog helps you transform chaotic lists into actionable insights. Implement it today to keep your distribution lists under control, and don’t hesitate to reach out in the comments if you need any clarification.