Asking what groups somebody is in returns all of them together: security groups, Microsoft 365 groups, distribution lists, and any directory roles they hold.

The directory roles are the part people forget to ask about, and they are usually the most interesting line in the answer.

Nothing is changed by asking, so this is the safe first step before removing anybody from anything.

Before you begin

Have the person’s email address.

Know why you are asking. Auditing access and chasing an unexpected email lead to different parts of the same answer.

Ask Avvi

1. Open chat and check the client.
2. Ask what groups the person is in. For example: what groups is jane@example.com in?
3. Read the result, including any directory roles.

Avvi returns every membership it can see for that person.

Good to know

Run this before offboarding somebody, because it shows what will need unpicking.

Membership of a distribution list explains mail arriving that the person did not expect. Membership of a security group explains access.

Verify it worked

Compare the answer against what you expected. Anything unexpected is the point of having asked.

For an offboarding, work through the list rather than assuming the obvious ones are all of it.

If something doesn’t look right

If the list is shorter than expected, confirm you are on the right client and the right person.

If a group you know exists is missing, check whether the person is a member through another group rather than directly.

If somebody holds a role you did not expect, treat that as the finding rather than an error.

To report a problem, open a support conversation from the Help drawer with the client and the person.

FAQ

Q: Does this include distribution lists?

A: Yes, along with security groups, Microsoft 365 groups and directory roles.

Q: Does asking change anything?

A: No.

Q: Can I ask about several people at once?

A: Ask for one at a time. The answer is long enough that a batch is hard to read.