使用 PowerShell 将 Microsoft Entra ID 用户导出为 CSV
我们希望使用 PowerShell 将 Microsoft Entra ID 用户信息导出到 CSV。为什么我们需要使用 PowerShell 列出 Microsoft Entra ID 用户？例如，我们想知道是否每个 Microsoft Entra ID 用户都具有正确的属性。那是因为服务台需要这些信息。在本文中，您将了解如何使用 PowerShell 将 Microsoft Entra ID 用户导出到 CSV 文件。
信息导出 Microsoft Entra ID 用户 PowerShell 脚本
Export-EntraIDUsers.ps1 PowerShell 脚本将针对 Microsoft Entra 租户运行。之后，它将报告导出为 CSV 文件。您可以使用 Microsoft Excel 或支持 CSV 文件扩展名的任何其他应用程序打开 CSV 文件。
该脚本将收集每个用户的以下信息：
- ID
- 名
- 姓
- 显示名称
- 用户主体名称
- 域名
- 电子邮件
- 职称
- 经理显示名称
- 管理员用户主体名称
- 部门
- 公司
- 办公室
- 员工编号
- 移动的
- 电话
- 街道
- 城市
- 邮政编码
- 状态
- 国家
- 用户类型
- 本地同步
- 账户状态
- 帐户创建于
- 上次成功登录（需要 Microsoft Entra ID P1/P2 许可证）
- 已获得许可
- MFA状态（包括身份验证方法）
使用 PowerShell 将 Microsoft Entra ID 用户导出为 CSV
让我们完成这些步骤并使用 PowerShell 将 Microsoft Entra ID 用户导出到 CSV 文件。
步骤 1. 安装 Microsoft Graph PowerShell
以管理员身份运行 Windows PowerShell 并安装 Microsoft Graph PowerShell。
Install-Module Microsoft.Graph -ForceInstall-Module Microsoft.Graph.Beta -AllowClobber -Force重要提示：始终安装 Microsoft Graph PowerShell 和 Microsoft Graph Beta PowerShell 模块。这是因为某些 cmdlet 在最终版本中尚不可用，并且无法运行。在运行 cmdlet 或脚本之前将两个模块更新到最新版本，以防止出现错误和不正确的结果。
步骤 2. 连接到 Microsoft Graph PowerShell
使用 Microsoft Graph PowerShell 连接到 Microsoft Entra。
Connect-MgGraph -Scopes "User.Read.All", "UserAuthenticationMethod.Read.All", "AuditLog.Read.All"输入您的全局管理员凭据并接受 Microsoft Graph 权限请求。
步骤 3. 准备导出 Microsoft Entra ID 用户 PowerShell 脚本
在(C:)驱动器上创建两个文件夹：
- 温度
- 脚本
下载 Export-EntraIDUsers.ps1 PowerShell 脚本并将其放置在 C:\scripts 文件夹中。该脚本会将 CSV 文件导出到 C:\temp 文件夹。
确保文件未被阻止，以防止运行脚本时出现错误。请阅读文章运行 PowerShell 脚本时出现未数字签名错误来了解更多信息。
另一种选择是将以下代码复制并粘贴到记事本中。将其命名为 Export-EntraIDUsers.ps1 并将其放置在 C:\scripts 文件夹中。
<#
.SYNOPSIS
Export-EntraIDUsers.ps1
.DESCRIPTION
Export Microsoft Entra ID users to CSV file.
.LINK
www.alitajran.com/export-microsoft-entra-id-users-to-csv-powershell
.NOTES
Written by: ALI TAJRAN
Website: www.alitajran.com
LinkedIn: linkedin.com/in/alitajran
.CHANGELOG
V1.10, 06/20/2023 - Initial version
V1.10, 06/21/2023 - Added license status and MFA status including methods
V1.20, 06/22/2023 - Added progress bar and last sign in date
V1.30, 07/24/2023 - Update for Microsoft Graph PowerShell changes
V1.40, 04/07/2024 - Added domain name
#>
# Connect to Microsoft Graph API
Connect-MgGraph -Scopes "User.Read.All", "UserAuthenticationMethod.Read.All", "AuditLog.Read.All"
# Create variable for the date stamp
$LogDate = Get-Date -f yyyyMMddhhmm
# Define CSV file export location variable
$Csvfile = "C:\temp\AllEntraIDUsers_$LogDate.csv"
# Retrieve users using the Microsoft Graph API with property
$propertyParams = @{
All = $true
# Uncomment below if you have Microsoft Entra ID P1/P2 to get last sign in date
# Property = 'SignInActivity'
ExpandProperty = 'manager'
}
$users = Get-MgBetaUser @propertyParams
$totalUsers = $users.Count
# Initialize progress counter
$progress = 0
# Initialize an array to store user objects
$userObjects = @()
# Loop through all users and collect user objects
foreach ($index in 0..($totalUsers - 1)) {
$user = $users[$index]
# Update progress counter
$progress++
# Calculate percentage complete
$percentComplete = ($progress / $totalUsers) * 100
# Define progress bar parameters
$progressParams = @{
Activity = "Processing Users"
Status = "User $($index + 1) of $totalUsers - $($user.userPrincipalName) - $($percentComplete -as [int])% Complete"
PercentComplete = $percentComplete
}
# Display progress bar
Write-Progress @progressParams
# Get manager information
$managerDN = $user.Manager.AdditionalProperties.displayName
$managerUPN = $user.Manager.AdditionalProperties.userPrincipalName
# Create an object to store user properties
$userObject = [PSCustomObject]@{
"ID" = $user.id
"First name" = $user.givenName
"Last name" = $user.surname
"Display name" = $user.displayName
"User principal name" = $user.userPrincipalName
"Domain name" = $user.userPrincipalName.Split('@')[1]
"Email address" = $user.mail
"Job title" = $user.jobTitle
"Manager display name" = $managerDN
"Manager user principal name" = $managerUPN
"Department" = $user.department
"Company" = $user.companyName
"Office" = $user.officeLocation
"Employee ID" = $user.employeeID
"Mobile" = $user.mobilePhone
"Phone" = $user.businessPhones -join ','
"Street" = $user.streetAddress
"City" = $user.city
"Postal code" = $user.postalCode
"State" = $user.state
"Country" = $user.country
"User type" = $user.userType
"On-Premises sync" = if ($user.onPremisesSyncEnabled) { "enabled" } else { "disabled" }
"Account status" = if ($user.accountEnabled) { "enabled" } else { "disabled" }
"Account Created on" = $user.createdDateTime
# Uncomment below if you have Microsoft Entra ID P1/P2 to get last succesful sign in date
# "Last sign in" = if ($user.SignInActivity.LastSuccessfulSignInDateTime) { $user.SignInActivity.LastSuccessfulSignInDateTime } else { "No sign in" }
"Licensed" = if ($user.assignedLicenses.Count -gt 0) { "Yes" } else { "No" }
"MFA status" = "-"
"Email authentication" = "-"
"FIDO2 authentication" = "-"
"Microsoft Authenticator App" = "-"
"Password authentication" = "-"
"Phone authentication" = "-"
"Software Oath" = "-"
"Temporary Access Pass" = "-"
"Windows Hello for Business" = "-"
}
$MFAData = Get-MgBetaUserAuthenticationMethod -UserId $user.userPrincipalName
# Check authentication methods for each user
foreach ($method in $MFAData) {
Switch ($method.AdditionalProperties["@odata.type"]) {
"#microsoft.graph.emailAuthenticationMethod" {
$userObject."Email authentication" = $true
$userObject."MFA status" = "Enabled"
}
"#microsoft.graph.fido2AuthenticationMethod" {
$userObject."FIDO2 authentication" = $true
$userObject."MFA status" = "Enabled"
}
"#microsoft.graph.microsoftAuthenticatorAuthenticationMethod" {
$userObject."Microsoft Authenticator App" = $true
$userObject."MFA status" = "Enabled"
}
"#microsoft.graph.passwordAuthenticationMethod" {
$userObject."Password authentication" = $true
# When only the password is set, then MFA is disabled.
if ($userObject."MFA status" -ne "Enabled") {
$userObject."MFA status" = "Disabled"
}
}
"#microsoft.graph.phoneAuthenticationMethod" {
$userObject."Phone authentication" = $true
$userObject."MFA status" = "Enabled"
}
"#microsoft.graph.softwareOathAuthenticationMethod" {
$userObject."Software Oath" = $true
$userObject."MFA status" = "Enabled"
}
"#microsoft.graph.temporaryAccessPassAuthenticationMethod" {
$userObject."Temporary Access Pass" = $true
$userObject."MFA status" = "Enabled"
}
"#microsoft.graph.windowsHelloForBusinessAuthenticationMethod" {
$userObject."Windows Hello for Business" = $true
$userObject."MFA status" = "Enabled"
}
}
}
# Add user object to the array
$userObjects += $userObject
}
# Complete the progress bar
Write-Progress -Activity "Processing Users" -Completed
# Export all user objects to CSV
$userObjects | Sort-Object "Display name" | Export-Csv -Path $Csvfile -NoTypeInformation -Encoding UTF8 #-Delimiter ";"这就是它的样子。
步骤 4. 运行导出 Microsoft Entra ID 用户 PowerShell 脚本
运行 PowerShell 脚本将 Microsoft Entra ID 用户导出到 CSV 文件。等到它完成。
C:\scripts\.\Export-EntraIDUsers.ps1步骤 5. 验证 Microsoft Entra ID 用户报告 CSV 文件
转到 temp 文件夹并验证您是否看到 AllEntraIDUsers_ 文件。
使用您喜欢的应用程序打开 CSV 文件。在我们的示例中，它是 Microsoft Excel。
一切看起来都很棒！
了解更多：将 Microsoft Entra Connect 迁移到新服务器 »
结论
您了解了如何使用 PowerShell 将 Microsoft Entra ID 用户导出到 CSV。每个用户帐户中都包含大量信息。使用 PowerShell，您可以获得适合您需求的自定义报告。
您喜欢这篇文章吗？您可能还喜欢查找 Microsoft Entra Connect 帐户。不要忘记关注我们并分享这篇文章。