Fetch Distribution Groups Using Graph PowerShell

Distribution Groups (also known as Distribution Lists) play a key role in traditional email-based communication across Microsoft 365 tenants. Unlike security groups or unified groups, distribution groups are strictly email-centric and are not used for permissions or collaborative workspaces.

This article demonstrates how to identify and fetch only Distribution Groups using Microsoft Graph PowerShell. We’ll walk through the script, explain how it works, suggest improvements, highlight possible errors, and wrap it up with a practical conclusion.

The Script

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "Group.Read.All"
                                
# Retrieve only distribution lists (mail-enabled, NOT security or unified groups)
$distributionLists = Get-MgGroup -All | Where-Object {
    $_.MailEnabled -eq $true -and
    $_.SecurityEnabled -eq $false -and
    ($_.GroupTypes -eq $null -or $_.GroupTypes.Count -eq 0)
}
                                
# Output results
$distributionLists | Select DisplayName, Mail, Id

ii) How the Script Works

Let’s break down the components of the script:

• Connect-MgGraph: Establishes a connection to Microsoft Graph using the Group.Read.All permission, which is essential for accessing group metadata across the tenant.
• Get-MgGroup -All: Fetches all Microsoft 365 groups in the environment, including unified, security, and distribution groups.
• Filtering Logic:
• MailEnabled -eq $true: Ensures the group is configured to send and receive emails.
• SecurityEnabled -eq $false: Excludes security groups that are typically used for permission management.
• GroupTypes -eq $null -or Count -eq 0: Excludes Unified Groups (Microsoft 365 Groups), which always have GroupTypes populated (e.g., "Unified").
• Output Section: Only essential properties (DisplayName, Mail, and Id) are selected for display in the PowerShell console.

iii) Further Enhancing the Script

Here are a few ideas to build on top of the base script:

• Export Results to CSV

$distributionLists | Select DisplayName, Mail, Id | Export-Csv "DistributionGroups.csv" -NoTypeInformation

• Add More Properties

Include other useful properties such as CreatedDateTime, Description, or Visibility for a more detailed report.

• Sort or Filter by Naming Convention

Want to isolate certain departments? Add filters like:

$distributionLists | Where-Object { $_.DisplayName -like "HR*" }

• Automate Reporting

Schedule the script using Task Scheduler or Azure Automation to run periodic reports on Distribution Groups.

iv) Possible Errors & Solutions

Error Message	Cause	Solution
Access Denied or Insufficient privileges	Missing Group.Read.All delegated or application permissions.	Ensure you connect with Connect-MgGraph -Scopes "Group.Read.All" and that admin consent is granted.
Get-MgGroup returns limited results	By default, Get-MgGroup is paginated.	Use the -All parameter to retrieve all groups across all pages.
GroupTypes is not recognized	Null or empty values can throw exceptions if not handled properly.	Use condition: ($null -eq $_.GroupTypes -or $_.GroupTypes.Count -eq 0) to avoid runtime issues.

Conclusion

Using Microsoft Graph PowerShell to fetch distribution groups offers precise control and visibility into how your organization manages group-based email communication. This script provides a reliable way to isolate classic distribution lists from the broader set of groups in your Microsoft 365 environment.

Whether you want to audit group types, generate compliance reports, or clean up unused distribution lists, this script gives you a strong foundation to build upon.

💡 For optimal results, integrate this script into regular administrative audits to keep your group directory organized and up to date.