Script Repository

$skipGroups = @("Group1", "Group2") # TODO: modify me

# E-mail settings
$to = "recipient@domain.com" # TODO: modify me
$subject = "Groups report" # TODO: modify me
$reportHeader = "<h2>The user has been removed from the following groups:</h2>" # TODO: modify me
$reportFooter = "<hr /><p><i>Please do not reply to this e-mail, it has been sent to you for notification purposes only.</i></p>" # TODO: modify me

# Get the user's unique identifier in Microsoft 365
try
{
    $objectId = ([Guid]$Context.TargetObject.Get("adm-O365ObjectId")).ToString()
}
catch
{
    $Context.LogMessage("The user doesn't have an account in Microsoft 365", "Warning")
    return
}

try
{
    # Connect to Exchange Online
    $session = $Context.CloudServices.CreateExchangeOnlinePSSession()
    Import-PSSession $session -AllowClobber -DisableNameChecking -CommandName "Get-User", "Get-Recipient", "Remove-DistributionGroupMember"
    
    # Connect to Azure AD
    $token = $Context.CloudServices.GetAzureAuthAccessToken("https://graph.windows.net/")
    $tenant = $Context.CloudServices.GetO365Tenant()
    $credential = $tenant.GetCredential()
    Connect-AzureAD -AccountId $credential.AppId -AadAccessToken $token -TenantId $tenant.TenantId
    
    # Get user DN
    $user = Get-User $objectId
    $userDN = $user.DistinguishedName
    
    # Get all groups in Exchange Online the user is member of
    $groups = Get-Recipient -Filter "Members -eq '$userDN'" -RecipientTypeDetails "MailUniversalDistributionGroup","MailUniversalSecurityGroup"
    $groupList = New-Object "System.Text.StringBuilder"
    $passedGroupIDs = New-Object "System.Collections.Generic.HashSet[System.String]"
    foreach ($group in $groups)
    {
        $passedGroupIDs.Add($group.ExternalDirectoryObjectId)
        if ($skipGroups -contains $group.DisplayName)
        {
            continue
        }
        
        try
        {
            # Remove the user from group
            Remove-DistributionGroupMember $group.ExternalDirectoryObjectId -Member $objectId -Confirm:$False -ErrorAction Stop -BypassSecurityGroupManagerCheck
        }
        catch
        {
            $Context.LogMessage("Cannot remove the user from group $($group.DisplayName). Error message: " + $_.Exception.Message, "Warning")
            continue
        }
        
        [void]$groupList.Append("<li>" + $group.DisplayName + "</li>")
    }
    
    # Get all groups in Microsoft 365 the user is member of
    $groups = Get-AzureADUserMembership -ObjectId $objectId -All:$True
    foreach ($group in $groups)
    {
        if ($skipGroups -contains $group.DisplayName)
        {
            continue
        }
        
        if ($passedGroupIDs.Contains($group.ObjectId))
        {
            continue
        }
        
        try
        {
            # Remove the user from group
            Remove-AzureADGroupMember -ObjectId $group.ObjectId -MemberId $objectId -ErrorAction Stop
        }
        catch
        {
            $Context.LogMessage("Cannot remove the user from group $($group.DisplayName). Error message: " + $_.Exception.Message, "Warning")
            continue
        }
        
        [void]$groupList.Append("<li>" + $group.DisplayName + "</li>")
    }
    
}
finally
{
    # Close the remote session and release resources
    if ($session) { Remove-PSSession $session }
    Disconnect-AzureAD
}

if ($groupList.Length -eq 0)
{
    return
}

# Build report
$html = New-Object "System.Text.StringBuilder"
[void]$html.Append($reportHeader)
[void]$html.Append("<ul>")
[void]$html.Append($groupList.ToString())
[void]$html.Append("</ul>")
[void]$html.Append($reportFooter)

# Send mail
$Context.SendMail($to, $subject, $NULL, $html.ToString())