Commands › Exchange Online

Get-SecurityPrincipal

Exchange Online ExchangeOnlineManagement Get-*

Return a list of security principals. Security principals are entities, such as users or security groups, which can be assigned permissions and user rights.

Quick start script

# Get-SecurityPrincipal — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Get-SecurityPrincipal | Format-List

# 3. Export for evidence / drift tracking
Get-SecurityPrincipal | Export-Clixml .\SecurityPrincipal-$(Get-Date -Format yyyyMMdd).xml

Syntax

Get-SecurityPrincipal [[-Identity] <ExtendedSecurityPrincipalIdParameter>]
 [-DomainController <Fqdn>]
 [-Filter <String>]
 [-IncludeDomainLocalFrom <SmtpDomain>]
 [-OrganizationalUnit <ExtendedOrganizationalUnitIdParameter>]
 [-ResultSize <Unlimited>]
 [-RoleGroupAssignable]
 [-Types <MultiValuedProperty>]
 [<CommonParameters>]

Parameters (8)

ParameterTypeRequiredWhat it controls
-Identity ExtendedSecurityPrincipalIdParameter The Identity parameter specifies the security principal. When the security principal is explicitly specified by using this parameter, no additional security principals are returned.
-DomainController Fqdn This parameter is available only in on-premises Exchange.
-Filter String The Filter parameter uses OPATH syntax to filter the results by the specified properties and values. The search criteria uses the syntax `"Property -ComparisonOperator 'Value'"`.
-IncludeDomainLocalFrom SmtpDomain This parameter is available only in on-premises Exchange.
-OrganizationalUnit ExtendedOrganizationalUnitIdParameter The OrganizationalUnit parameter filters the results based on the object's location in Active Directory. Only objects that exist in the specified location are returned. Valid input for this parameter is an...
-ResultSize Unlimited The ResultSize parameter specifies the maximum number of results to return. If you want to return all requests that match the query, use unlimited for the value of this parameter. The default value is 1000.
-RoleGroupAssignable SwitchParameter The RoleGroupAssignable switch filters security principals by returning only objects that can be assigned to an RBAC role group. You don't need to specify a value with this switch.
-Types MultiValuedProperty The Types parameter filters the results by object type. Valid values are:

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.