For SuryB

group-use-report.ps1

# Connect to Microsoft Graph if not already connected
if (-not (Get-MgContext)) {
    Connect-MgGraph -Scopes "Policy.Read.All","Group.Read.All","Application.Read.All","Directory.Read.All"
}

$results = @()

# Conditional Access Policies
$caPolicies = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies"
foreach ($policy in $caPolicies.value) {
    foreach ($groupId in $policy.conditions.users.includeGroups) {
        $group = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/groups/$groupId"
        $results += [PSCustomObject]@{
            groupId     = $group.id
            displayName = $group.displayName
            usedIn      = "Conditional Access policy - ($($policy.Id))"
        }
    }
    foreach ($groupId in $policy.conditions.users.excludeGroups) {
        $group = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/groups/$groupId"
        $results += [PSCustomObject]@{
            groupId     = $group.id
            displayName = $group.displayName
            usedIn      = "Conditional Access policy (excluded) - ($($policy.Id))"
        }
    }
}

# Enterprise Application Assignments
$servicePrincipals = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/servicePrincipals"
foreach ($sp in $servicePrincipals.value) {
    $assignments = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/servicePrincipals/$($sp.id)/appRoleAssignedTo"
    foreach ($assignment in $assignments.value) {
        if ($assignment.principalType -eq "Group") {
            $group = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/groups/$($assignment.principalId)"
            $results += [PSCustomObject]@{
                groupId     = $group.id
                displayName = $group.displayName
                usedIn      = "Enterprise application assignment - $($sp.displayName) (App ID: $($sp.appId))"
            }
        }
    }
}

# Authentication Methods Policy
$authMethodPolicy = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy"
foreach ($method in $authMethodPolicy.authenticationMethodConfigurations) {
    foreach ($groupId in ($method.includeTargets | Where-Object { $_.targetType -eq "group" -and $_.id -ne "all_users" }).id) {
        $group = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/groups/$groupId"
        $results += [PSCustomObject]@{
            groupId     = $group.id
            displayName = $group.displayName
            usedIn      = "Authentication method policy"
        }
    }
}