How to Report Managers and Direct Reports from Entra ID

Use the Microsoft Graph To Retrieve Information from Entra ID

In 2021, I wrote about how to create a report about managers and direct reports. The article explained how to use cmdlets from the Azure AD PowerShell module to retrieve details about managers and their reports. The text went on to explain how the Get-User cmdlet from the Exchange Online management module can also do the job.

The original script is available from GitHub and the Get-User approach still works. However, the world has moved on, and the Microsoft Graph APIs are now the preferred method to get this kind of information, so it’s worth revisiting the topic. Despite the advent of AI, magically associating managers with direct reports still can’t happen, so this kind of exercise depends on accurate population of Entra ID.

First Attempt to Find Managers and Direct Reports

The first run to find managers and direct reports might look like the code shown below. This code finds the set of licensed member accounts and uses the Get-MgUserDirectReport cmdlet for each account to return any direct reports. The code works but it requires processing each account and is therefore unsuitable for anything but smaller organizations.

[array]$ManagersWithReports = @()

[array]$Users = Get-MgUser -Filter "assignedLicenses/`$count ne 0 and userType eq 'Member'" -ConsistencyLevel Eventual -CountVariable Count -All -PageSize 500

ForEach ($User in $Users) {
    $Reports = Get-MgUserDirectReport -UserId $User.Id -ErrorAction SilentlyContinue
    if ($Reports) {
        $ManagersWithReports += [PSCustomObject]@{
            DisplayName       = $user.DisplayName
            UserPrincipalName = $user.UserPrincipalName
            DirectReports     = $Reports.Count
        }
    }
}

$ManagersWithReports | Sort-Object DirectReports -Descending | Format-Table DisplayName, DirectReports

DisplayName                             DirectReports

Kim Akers (She/Her)                                17
James Ryan                                         11
Brian Weakliam (Operations)                         3
Paul Robichaux (Office 365 for IT Pros)             1
René Artois                                         1
Chris Bishop                                        1
Tony Redmond                                        1
Andy Ruth (Project Director)                        1        

Seeking a Single Pass

A better and more efficient approach is to make a single pass through the users endpoint to fetch users and their managers. Manager is a supported property for user accounts, but retrieving manager details requires an expansion operation to fetch the properties of the manager object.

A further complication is that the users endpoint doesn’t support a complex query like the one used to find licensed users in conjunction with expanding a property. This is one of those little foibles that make the Graph so infuriating to work with at times.

The solution is to use a server-side filter to find member accounts followed by a client-side filter to remove unlicensed accounts. This strategy maximizes the benefits of the server-side filter by removing guest accounts. Most tenants are likely to have more guest accounts than unlicensed accounts to process. The code is therefore:

[array]$Users = Get-MgUser -Filter "userType eq 'Member'" -ExpandProperty Manager -Select Id, displayName, Manager, assignedlicenses -All -PageSize 500 | Where-Object {$_.assignedlicenses.count -ne 0}

Expansion instructs the Graph to populate the Manager property with the identifier for the manager’s account. It also returns additionalProperties containing other account properties:

$User[0].manager | Format-List

DeletedDateTime      :
Id                   : d36b323a-32c3-4ca5-a4a5-2f7b4fbef31c
AdditionalProperties : {[@odata.type, #microsoft.graph.user], [accountEnabled, True], [businessPhones, System.Object[]], [city, NYC]…}

The work to report managers and their direct reports is straightforward. Analyze each user to find the manager information. Extract a set of managers and create a report of the managers and their direct reports and output the results (Figure 1).

You can download the complete script from the Office 365 for IT Pros GitHub repository.

Mastering the Graph Takes Time

There’s no doubt that the Microsoft Graph APIs are very functional and expose many different forms of Microsoft 365 data for tenants. Sometimes figuring out the best way to retrieve data takes more time than anticipated because of how the Graph works. I guess it’s what makes things interesting, and it’s why we have the Automating Microsoft 365 with PowerShell eBook.

---

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.