MS Entra – Users – Get User Groups

Get groups for a user in Entra ID.

Action details

Property	Value
Action label	MS Entra – Users – Get User Groups
Category	CloudTools
Apex class and method	GetEntraUserGroups.getUserGroups
Input type	GetEntraUserGroups.GetEntraUserGroupsInput
Output type	List<List<MSEntraGroup>>
Authorization	Microsoft 365 connector; supported authorization depends on the endpoint and target.
Microsoft Graph request	GET /users/{userIdOrPrincipalName}/memberOf/microsoft.graph.group

Prerequisites and permissions

Configure a CloudTools Connector with Connector Type set to Microsoft 365. Complete sign-in for OAuth Delegated (Authorization Code). For supported OAuth Application (Client Credentials) requests, grant application permissions and administrator consent. The identity must have access to the selected resource; directory operations can also require Microsoft Entra roles. Use Creating an Entra ID App and Integration Connectors for setup.

The action permission provider declares these alternatives. They are not cumulative requirements, not all are least privileged, and a scope can have target-specific restrictions. Check the Microsoft operation reference before selecting permissions.

Permission type	Declared alternatives
Delegated	User.Read, User.Read.All, Directory.Read.All, Directory.ReadWrite.All, GroupMember.Read.All
Application	Directory.Read.All, Directory.ReadWrite.All

Endpoints: /users/{id | userPrincipalName}/memberOf/microsoft.graph.group

See the Microsoft operation and permissions reference.

Inputs

Input	Apex field	Type	Required	Description
User Id or Principal Name	userIdOrPrincipalName	String	Yes	User id or principal name to query groups for
Filter Query	filterQuery	String	No	OData $filter query string
Select Query	selectQuery	String	No	OData $select query string
Order By Query	orderbyQuery	String	No	OData $orderby query string
Top Query	topQuery	String	No	OData $top query string

Supply a nonempty list with a non-null first request. Graph actions process only that first request. Global inputs do not expose connectorId; subscriber Apex and Flow use CloudTools connector selection. Use Microsoft Graph resource IDs or the specifically documented user identifier, and resolve dynamic values before invocation.

Outputs

Returns an outer list containing one resource collection. It is not one collection for every input request. A null response or unmapped value produces an empty inner collection.

Output	Apex field	Type	Description
Id	id	String	Unique identifier for the group
OData Type	odataType	String	OData type for the group
Deleted Date Time	deletedDateTime	String	Date and time when the group was deleted
Created Date Time	createdDateTime	String	Date and time when the group was created
Description	description	String	Description for the group
Display Name	displayName	String	Display name for the group
Expiration Date Time	expirationDateTime	String	Date and time when the group is set to expire
Group Types	groupTypes	List<String>	Group types (for example: Unified, DynamicMembership)
Mail	mail	String	SMTP address for the group
Mail Enabled	mailEnabled	Boolean	Whether the group is mail-enabled
Mail Nickname	mailNickname	String	Mail alias for the group
Membership Rule	membershipRule	String	Dynamic membership rule for the group
Membership Rule Processing State	membershipRuleProcessingState	String	Processing state of the dynamic membership rule
On-Premises Domain Name	onPremisesDomainName	String	On-premises domain name (if synced)
On-Premises Last Sync Date Time	onPremisesLastSyncDateTime	String	Last sync time with on-premises directory
On-Premises NetBios Name	onPremisesNetBiosName	String	On-premises NetBios name (if synced)
On-Premises Sam Account Name	onPremisesSamAccountName	String	On-premises SAM account name (if synced)
On-Premises Security Identifier	onPremisesSecurityIdentifier	String	On-premises security identifier (if synced)
On-Premises Sync Enabled	onPremisesSyncEnabled	Boolean	Whether the group is synced from on-premises
Preferred Data Location	preferredDataLocation	String	Preferred data location for the group
Preferred Language	preferredLanguage	String	Preferred language for the group
Proxy Addresses	proxyAddresses	List<String>	Proxy addresses for the group
Renewed Date Time	renewedDateTime	String	Date and time when the group was last renewed
Security Enabled	securityEnabled	Boolean	Whether the group is a security group
Security Identifier	securityIdentifier	String	Security identifier for the group
Visibility	visibility	String	Group join policy and content visibility (Private, Public, HiddenMembership)
Classification	classification	String	Classification for the group
Is Assignable To Role	isAssignableToRole	Boolean	Whether the group can be assigned to a role
Theme	theme	String	Microsoft 365 group theme
Unique Name	uniqueName	String	Unique name for the group
Allow External Senders	allowExternalSenders	Boolean	Whether external senders can email the group
Auto Subscribe New Members	autoSubscribeNewMembers	Boolean	Whether new members are auto-subscribed to email
Hide From Address Lists	hideFromAddressLists	Boolean	Whether the group is hidden from address lists
Hide From Outlook Clients	hideFromOutlookClients	Boolean	Whether the group is hidden from Outlook clients
Is Subscribed By Mail	isSubscribedByMail	Boolean	Whether the signed-in user is subscribed by mail
Is Archived	isArchived	Boolean	Whether the associated team is archived
Unseen Count	unseenCount	Integer	Count of unseen conversations for the signed-in user
Has Members With License Errors	hasMembersWithLicenseErrors	Boolean	Whether the group has members with license errors
Is Management Restricted	isManagementRestricted	Boolean	Whether the group is in a restricted management unit
License Processing State	licenseProcessingState	String	Processing state of group license assignment
Additional Properties	additionalProperties	List<DynamicObject>	Additional properties from user-defined query

Behavior and limits

This implementation maps the returned collection without following or exposing @odata.nextLink. A result can contain only the first page; do not treat it as a complete tenant or resource inventory.

Query inputs are passed through or mapped to OData parameters as implemented. Endpoint-specific query support, advanced directory query requirements, and property visibility still apply.

Retrieves direct memberOf entries cast to microsoft.graph.group. It does not calculate transitive group membership.

Use in Flow

Use MS Entra – Users – Get User Groups where supported. Use a Microsoft 365 application connector configured as Set as default for Flow automations only if the endpoint and target support application access. Supply required values, retain useful outputs, and add fault handling. Delegated connections are not supported for CloudTools Flow automation. The action processes only the first input request.

Use in custom Apex

This subscriber-org example uses the Apptigent namespace. Replace identifiers and example values before use. Configure the connector, complete authorization first, run in a context permitting callouts, and handle exceptions, empty results, and unmapped fields.

Apptigent.GetEntraUserGroups.GetEntraUserGroupsInput request =
    new Apptigent.GetEntraUserGroups.GetEntraUserGroupsInput();
request.userIdOrPrincipalName = 'alex@contoso.com';
request.filterQuery = 'startswith(displayName,\'Sales\')';
request.selectQuery = 'id,displayName,mail';
request.orderbyQuery = 'displayName asc';
request.topQuery = '25';



List<List<Apptigent.MSEntraGroup>> results =
    Apptigent.GetEntraUserGroups.getUserGroups(
        new List<Apptigent.GetEntraUserGroups.GetEntraUserGroupsInput>{ request }
    );
System.debug(results);

Use in a Lightning Web Component

Use getEntraUserGroups from msEntraConnectorLib through MSEntraConnectorController. These c/ imports apply in the same namespace. Set request.connectorId for direct MSEntraAction calls. The controller captures the request selection for MSEntraAction.

Global input	LWC request mapping
userIdOrPrincipalName	request.userIdOrPrincipalName
filterQuery	request.filterQuery
selectQuery	request.selectQuery
orderbyQuery	request.orderbyQuery
topQuery	request.topQuery

entraActionExample.js

import { LightningElement } from 'lwc';
import { getEntraUserGroups } from 'c/msEntraConnectorLib';

export default class EntraActionExample extends LightningElement {
    result = null;
    errorMessage = '';
    isRunning = false;
    completed = false;

    async handleRun() {
        if (this.isRunning || this.completed) return;
        this.isRunning = true;
        this.errorMessage = '';
        try {
            const request = { connectorId: 'REPLACE_WITH_CONNECTOR_RECORD_ID' };
            request.userIdOrPrincipalName = 'alex@contoso.com';
            request.filterQuery = 'startswith(displayName,\'Sales\')';
            request.selectQuery = 'id,displayName,mail';
            request.orderbyQuery = 'displayName asc';
            request.topQuery = '25';
            this.result = await getEntraUserGroups(request);
            this.completed = true;
        } catch (error) {
            this.errorMessage = error.requiresInteractiveAuthorization
                ? 'Sign in to Microsoft for the connector, then try again.'
                : error.message || 'The Entra action failed.';
        } finally {
            this.isRunning = false;
        }
    }
}

entraActionExample.html

<template>
    <lightning-button label="Run action" onclick={handleRun}
        disabled={isRunning}></lightning-button>
    <p role="alert">{errorMessage}</p>
</template>

The library returns an array of mapped DTOs. The controller can flatten nested fields, serialize data, or map an action result into an operation DTO. rawJson contains serialized mapped Apex data rather than the untouched Graph response.

Use getMSEntraAuthorizationState, beginMSEntraAuthorization, and createMSEntraOAuthMessageHandler to arrange delegated sign-in. The library normalizes errors but does not automatically sign in or retry. Reset completed for a new deliberate operation, and inspect resource state before retrying a mutation with an uncertain outcome.

Error handling and troubleshooting

Symptom	What to check
Required fields error	Supply a nonempty request list and required or conditionally required inputs. For LWC, use the mapped field names.
Authorization or access denied	Check connector selection, sign-in, endpoint/target permission support, administrator consent, directory roles, and resource access.
Resource not found	Check Microsoft IDs and parent resource relationships. Preserve group/drive/item associations and mailbox/calendar/event IDs.
Missing or unexpected output	Check query support, pagination, wrapper versus item models, public-only properties, and mapped DTO fields.
Operation rejected	Inspect the Microsoft error, supported writable fields, group/calendar restrictions, recipient/license data, and file transfer limits.

See Entra connector introduction.