Filtering Data Using Graph PowerShell

When working with Microsoft Graph PowerShell, you’ll often be dealing with large sets of data—users, groups, or other directory objects. To make sense of all that information, filters come to the rescue. They help you narrow down results so you only get what’s relevant.

In this blog, we’ll explore four powerful ways to filter data in Graph PowerShell:

1. Filter Query Parameter (-Filter)
2. Where-Object (Where-Object {})
3. Search Query (-Search)
4. Select-Object (Select-Object)

Let’s break these down one by one with practical examples.

• Filter Query Parameter (-Filter)

The -Filter parameter allows you to refine results directly at the Graph API level before they even reach your PowerShell session. This means the filtering happens server-side, making it faster and more efficient when you’re dealing with large datasets.

Examples:
# Get all users from the Sales department
Get-MgUser -Filter "department eq 'Sales'"
                                                
# Get all users with the job title 'Technical Writer'
Get-MgUser -Filter "jobTitle eq 'Technical Writer'"
                                                
# Get all enabled accounts
Get-MgUser -Filter "accountEnabled eq true"
                                            

In simple words: -Filter is your first line of defense against clutter. Instead of downloading all users and then filtering, you ask Graph to only bring what you care about.

• Where-Object

Sometimes you’ll need to filter data after it has been retrieved. That’s where Where-Object comes in. Unlike -Filter, which talks directly to Graph, Where-Object works locally in PowerShell once the data is in memory.

Examples:

# Get all Microsoft 365 groups (Unified and Mail-enabled)
Get-MgGroup -All | Where-Object { $_.GroupTypes -contains "Unified" -and $_.MailEnabled -eq $true }
                                                
# Get all users with a specific license SKU
Get-MgUser -All -Select "DisplayName, AssignedLicenses" | 
Where-Object { $_.AssignedLicenses.SkuId -contains "c42b9cae-ea4f-4ab7-9717-81576235ccac" }
                                                
# Get users with a specific domain in their UPN
Get-MgUser -All | Where-Object { $_.UserPrincipalName -like "*@7xh7fj.onmicrosoft.com" }
                                            

Think of Where-Object as a fine-tuning tool. You already have the data in your hand, and now you’re shaping it to fit your exact needs.

• Search Query (string-based search)

For string-based filtering, Graph provides the -Search parameter. It’s especially useful when you need to look across multiple attributes (like names or departments) quickly. Unlike -Filter, which is strict and property-based, -Search is flexible and keyword-driven.

Examples:
# Search for users with 'John' in their display name
Get-MgUser -Search "displayName:John" -ConsistencyLevel eventual
                                                
# Search for users named John or belonging to the HR department
Get-MgUser -Search '"displayName:John" OR "department:HR"' -ConsistencyLevel eventual
                                            

In plain English: use -Search when you want a quick keyword hunt across your directory data.

• Select-Object

Select-Object doesn’t filter which records you get—it filters what fields you see from those records. It’s a great way to trim down the output to only the properties you care about.

Examples:

# Get only the DisplayName and JobTitle of a user
Get-MgUser -UserId "dexter@7xh7fj.onmicrosoft.com" | Select-Object DisplayName, JobTitle
                                                
# Get DisplayName, Id, and Description of a group
Get-MgGroup -GroupId 47c9e47d-82e6-4a77-81fc-f43fc00f53c2 | Select-Object DisplayName, Id, Description

Think of Select-Object as your output cleaner. It doesn’t reduce the number of items, but it makes the results more readable by showing only what matters.

When to Use What: Quick Comparison

Here’s a simple guide to help you choose the right filtering method:

Method	When to Use	Where Filtering Happens
Filter	When you want Graph to do the filtering before sending data. Best for large datasets.	Server-side (Graph API)
Where-Object	When you need advanced or complex conditions not supported by Graph.	Client-side (PowerShell)
-Search	When you need keyword-based searches across multiple properties.	Server-side (Graph API)
Select-Object	When you want to limit the output fields displayed, not the records themselves.	Client-side (PowerShell)

Best Practices for Filtering in Graph PowerShell

To get the most out of filtering, here are a few best practices:

1. Prefer -Filter over Where-Object for large datasets

Server-side filtering reduces the data that travels over the network, which makes your scripts faster and more efficient.

2. Use -Search for flexible lookups, but don’t overuse it

While handy, -Search is less precise than -Filter. Use it when you need quick keyword searches, but switch to -Filter for exact matches.

3. Combine filters wisely

For example, you can use -Filter to reduce the bulk of the data and then apply Where-Object locally for more advanced conditions not supported by Graph.

4. Keep outputs clean with Select-Object

Don’t overload your console with unnecessary properties. Show only what’s needed, especially if you plan to export results to CSV.

5. Test with small datasets first

Before running against your entire directory, test your filters on a smaller subset to ensure you’re getting the expected results.

Wrapping Up

Filtering in Graph PowerShell is all about control.

• Use -Filter when you want Graph to do the heavy lifting.
• Use Where-Object when you need more local, PowerShell-level filtering.
• Use -Search for flexible, keyword-driven queries.
• Use Select-Object to keep your output neat and tidy.

Mastering these tools will save you time, reduce clutter, and make your scripts far more efficient.