How to Get, Remove Owner & Remove Member from Exchange Online Groups Using PowerShell

As an M365 administrator, you often need to audit or clean up group ownership and membership — especially during employee offboarding or role transitions. The challenge? Microsoft 365 has three different group types, each managed by different cmdlets.

In this post, I'll share three ready-to-use PowerShell scripts that cover:

• Get owners of a group (all three types)
• Remove a user as an owner
• Remove a user as a member

All scripts read group names from a CSV file, making them ideal for bulk operations.

---

The Three Group Types in Exchange Online

Group Type	RecipientTypeDetails	Cmdlet Used
Microsoft 365 Group	GroupMailbox	Get-UnifiedGroup
Distribution Group	MailUniversalDistributionGroup	Get-DistributionGroup
Mail-enabled Security Group	MailUniversalSecurityGroup	Get-DistributionGroup

Each type stores ownership and membership differently, which is why a single cmdlet won't work for all.

---

Prerequisites

Install the required modules if not already installed:

Install-Module -Name ExchangeOnlineManagement -Force -AllowClobber
Install-Module -Name Microsoft.Graph -Force -AllowClobber

Connect before running any script:

Set-MgGraphOption -DisableLoginByWAM $true   # Fix WAM broker error on Windows
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

Note: Set-MgGraphOption -DisableLoginByWAM $true is required on some Windows environments to avoid a known MSAL authentication error.

---

Input: groups.csv

All three scripts read from a CSV with one column — GroupEmail:

GroupEmail
hr-team@contoso.com
all-staff@contoso.com
it-security@contoso.com

---

Script 1: Get Group Owners

This script detects the group type automatically and lists all current owners.

# ============================================================
# Get Group Owners from CSV
# ============================================================

Set-MgGraphOption -DisableLoginByWAM $true
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

$CsvPath = "C:\Scripts\groups.csv"

foreach ($row in (Import-Csv $CsvPath)) {
    $GroupEmail = $row.GroupEmail

    Write-Host "`n========== Detecting Group Type: $GroupEmail ==========`n" -ForegroundColor Cyan

    # Detect group type
    $unifiedGroup = Get-UnifiedGroup      -Identity $GroupEmail -ErrorAction SilentlyContinue
    $distGroup    = Get-DistributionGroup -Identity $GroupEmail -ErrorAction SilentlyContinue

    $groupType = if ($unifiedGroup) { "M365Group" }
                 elseif ($distGroup.RecipientTypeDetails -eq "MailUniversalDistributionGroup") { "DistributionGroup" }
                 elseif ($distGroup.RecipientTypeDetails -eq "MailUniversalSecurityGroup")     { "SecurityGroup" }
                 else { "Unknown" }

    Write-Host "Detected Type: $groupType" -ForegroundColor Yellow

    # Get owners based on type
    $owners = @()

    if ($groupType -eq "M365Group") {
        $owners = Get-UnifiedGroupLinks -Identity $GroupEmail -LinkType Owners -ResultSize Unlimited |
                  Select-Object DisplayName, PrimarySmtpAddress,
                                @{N="GroupType"; E={"M365Group"}},
                                @{N="GroupEmail"; E={$GroupEmail}}
    }
    elseif ($groupType -in "DistributionGroup", "SecurityGroup") {
        $owners = $distGroup.ManagedBy | ForEach-Object {
            $recipient = Get-Recipient $_ -ErrorAction SilentlyContinue
            [PSCustomObject]@{
                DisplayName        = $recipient.DisplayName
                PrimarySmtpAddress = $recipient.PrimarySmtpAddress
                GroupType          = $groupType
                GroupEmail         = $GroupEmail
            }
        }
    }

    if ($owners) {
        Write-Host "`nOwners found:" -ForegroundColor Green
        $owners | Format-Table DisplayName, PrimarySmtpAddress, GroupType, GroupEmail -AutoSize
    } else {
        Write-Host "No owners found or group type is Unknown." -ForegroundColor Red
    }
}

---

Script 2: Remove a User as Owner

This script removes a specific user from the owners list only — membership is not affected. It also includes safety checks: skips if the user is not an owner, and blocks removal if they are the only owner.

Important: Exchange Online does not allow removing the last owner of a group. You must assign another owner first.

# ============================================================
# Remove Owner from Groups (CSV)
# ============================================================

Set-MgGraphOption -DisableLoginByWAM $true
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

$CsvPath     = "C:\Scripts\groups.csv"
$RemoveOwner = "john.doe@contoso.com"

foreach ($row in (Import-Csv $CsvPath)) {
    $GroupEmail = $row.GroupEmail

    Write-Host "`n========== Detecting Group Type: $GroupEmail ==========`n" -ForegroundColor Cyan

    $unifiedGroup = Get-UnifiedGroup      -Identity $GroupEmail -ErrorAction SilentlyContinue
    $distGroup    = Get-DistributionGroup -Identity $GroupEmail -ErrorAction SilentlyContinue

    $groupType = if ($unifiedGroup) { "M365Group" }
                 elseif ($distGroup.RecipientTypeDetails -eq "MailUniversalDistributionGroup") { "DistributionGroup" }
                 elseif ($distGroup.RecipientTypeDetails -eq "MailUniversalSecurityGroup")     { "SecurityGroup" }
                 else { "Unknown" }

    Write-Host "Detected Type: $groupType" -ForegroundColor Yellow

    # Get owners
    $owners = @()
    if ($groupType -eq "M365Group") {
        $owners = Get-UnifiedGroupLinks -Identity $GroupEmail -LinkType Owners -ResultSize Unlimited |
                  Select-Object DisplayName, PrimarySmtpAddress,
                                @{N="GroupType"; E={"M365Group"}},
                                @{N="GroupEmail"; E={$GroupEmail}}
    }
    elseif ($groupType -in "DistributionGroup", "SecurityGroup") {
        $owners = $distGroup.ManagedBy | ForEach-Object {
            $recipient = Get-Recipient $_ -ErrorAction SilentlyContinue
            [PSCustomObject]@{
                DisplayName        = $recipient.DisplayName
                PrimarySmtpAddress = $recipient.PrimarySmtpAddress
                GroupType          = $groupType
                GroupEmail         = $GroupEmail
            }
        }
    }

    if ($owners) {
        Write-Host "`nOwners found:" -ForegroundColor Green
        $owners | Format-Table DisplayName, PrimarySmtpAddress, GroupType, GroupEmail -AutoSize
    } else {
        Write-Host "No owners found or group type is Unknown." -ForegroundColor Red
    }

    # --------------------------------------------------------
    # Remove Owner
    # --------------------------------------------------------
    Write-Host "`n========== Removing Owner: $RemoveOwner ==========`n" -ForegroundColor Cyan

    if ($groupType -eq "M365Group") {
        $currentOwners = Get-UnifiedGroupLinks -Identity $GroupEmail -LinkType Owners -ResultSize Unlimited
        $isOwner       = $currentOwners | Where-Object { $_.PrimarySmtpAddress -eq $RemoveOwner }

        if (-not $isOwner) {
            Write-Host "$RemoveOwner is not an owner of this group. Skipping." -ForegroundColor Yellow
        }
        elseif ($currentOwners.Count -eq 1) {
            Write-Host "Cannot remove $RemoveOwner - they are the only owner. Assign another owner first." -ForegroundColor Red
        }
        else {
            Remove-UnifiedGroupLinks -Identity $GroupEmail -LinkType Owners -Links $RemoveOwner -Confirm:$false
            Write-Host "Owner removed successfully from M365 Group." -ForegroundColor Green
        }
    }
    elseif ($groupType -in "DistributionGroup", "SecurityGroup") {
        $isOwner = $distGroup.ManagedBy | Where-Object { $_ -like "*$($RemoveOwner.Split('@')[0])*" }

        if (-not $isOwner) {
            Write-Host "$RemoveOwner is not an owner of this group. Skipping." -ForegroundColor Yellow
        }
        elseif ($distGroup.ManagedBy.Count -eq 1) {
            Write-Host "Cannot remove $RemoveOwner - they are the only owner. Assign another owner first." -ForegroundColor Red
        }
        else {
            Set-DistributionGroup -Identity $GroupEmail -ManagedBy @{Remove = $RemoveOwner}
            Write-Host "Owner removed successfully from $groupType." -ForegroundColor Green
        }
    }
    else {
        Write-Host "Cannot remove owner - Group type is Unknown." -ForegroundColor Red
    }
}

---

Script 3: Remove a User as Member

This script removes a specific user from the members list only — ownership is not affected. It checks if the user is actually a member before attempting removal, so no other members are touched.

Tip: For on-premises synced groups, Exchange Online will throw a permissions error. Those groups must be managed via Active Directory or on-prem Exchange Admin Center.

# ============================================================
# Remove Member from Groups (CSV)
# ============================================================

Set-MgGraphOption -DisableLoginByWAM $true
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

$CsvPath      = "C:\Scripts\groups.csv"
$RemoveMember = "john.doe@contoso.com"

foreach ($row in (Import-Csv $CsvPath)) {
    $GroupEmail = $row.GroupEmail

    Write-Host "`n========== Detecting Group Type: $GroupEmail ==========`n" -ForegroundColor Cyan

    $unifiedGroup = Get-UnifiedGroup      -Identity $GroupEmail -ErrorAction SilentlyContinue
    $distGroup    = Get-DistributionGroup -Identity $GroupEmail -ErrorAction SilentlyContinue

    $groupType = if ($unifiedGroup) { "M365Group" }
                 elseif ($distGroup.RecipientTypeDetails -eq "MailUniversalDistributionGroup") { "DistributionGroup" }
                 elseif ($distGroup.RecipientTypeDetails -eq "MailUniversalSecurityGroup")     { "SecurityGroup" }
                 else { "Unknown" }

    Write-Host "Detected Type: $groupType" -ForegroundColor Yellow

    # Get owners
    $owners = @()
    if ($groupType -eq "M365Group") {
        $owners = Get-UnifiedGroupLinks -Identity $GroupEmail -LinkType Owners -ResultSize Unlimited |
                  Select-Object DisplayName, PrimarySmtpAddress,
                                @{N="GroupType"; E={"M365Group"}},
                                @{N="GroupEmail"; E={$GroupEmail}}
    }
    elseif ($groupType -in "DistributionGroup", "SecurityGroup") {
        $owners = $distGroup.ManagedBy | ForEach-Object {
            $recipient = Get-Recipient $_ -ErrorAction SilentlyContinue
            [PSCustomObject]@{
                DisplayName        = $recipient.DisplayName
                PrimarySmtpAddress = $recipient.PrimarySmtpAddress
                GroupType          = $groupType
                GroupEmail         = $GroupEmail
            }
        }
    }

    if ($owners) {
        Write-Host "`nOwners found:" -ForegroundColor Green
        $owners | Format-Table DisplayName, PrimarySmtpAddress, GroupType, GroupEmail -AutoSize
    } else {
        Write-Host "No owners found or group type is Unknown." -ForegroundColor Red
    }

    # --------------------------------------------------------
    # Remove Member
    # --------------------------------------------------------
    Write-Host "`n========== Removing Member: $RemoveMember ==========`n" -ForegroundColor Cyan

    if ($groupType -eq "M365Group") {
        $isMember = Get-UnifiedGroupLinks -Identity $GroupEmail -LinkType Members -ResultSize Unlimited |
                    Where-Object { $_.PrimarySmtpAddress -eq $RemoveMember }

        if ($isMember) {
            try {
                Remove-UnifiedGroupLinks -Identity $GroupEmail -LinkType Members -Links $RemoveMember -Confirm:$false -ErrorAction Stop
                Write-Host "Member removed successfully from M365 Group." -ForegroundColor Green
            } catch {
                Write-Host "ERROR removing member from M365 Group: $_" -ForegroundColor Red
            }
        } else {
            Write-Host "$RemoveMember is not a member of this group. Skipping." -ForegroundColor Yellow
        }
    }
    elseif ($groupType -in "DistributionGroup", "SecurityGroup") {
        $isMember = Get-DistributionGroupMember -Identity $GroupEmail -ResultSize Unlimited |
                    Where-Object { $_.PrimarySmtpAddress -eq $RemoveMember }

        if ($isMember) {
            try {
                Remove-DistributionGroupMember -Identity $GroupEmail -Member $RemoveMember -Confirm:$false -ErrorAction Stop
                Write-Host "Member removed successfully from $groupType." -ForegroundColor Green
            } catch {
                Write-Host "ERROR removing member from $groupType : $_" -ForegroundColor Red
            }
        } else {
            Write-Host "$RemoveMember is not a member of this group. Skipping." -ForegroundColor Yellow
        }
    }
    else {
        Write-Host "Cannot remove member - Group type is Unknown." -ForegroundColor Red
    }
}

---

Key Points to Remember

Scenario	What Happens
M365 Group — Remove Owner	Uses Remove-UnifiedGroupLinks -LinkType Owners. Member link is kept.
M365 Group — Remove Member	Uses Remove-UnifiedGroupLinks -LinkType Members. Owner link is kept.
DG / Security Group — Remove Owner	Uses Set-DistributionGroup -ManagedBy @{Remove=...}
DG / Security Group — Remove Member	Uses Remove-DistributionGroupMember
Only one owner left	Script blocks removal and shows a red warning
User not in group	Script skips with a yellow message — no error thrown
On-premises synced group	Must be managed via Active Directory, not Exchange Online

---

Conclusion

Managing Exchange Online group ownership and membership across multiple group types doesn't have to be complex. By detecting the group type dynamically and applying the right cmdlet per type, these scripts handle all three group types reliably from a simple CSV input. The built-in safety checks — solo owner protection, membership validation, and skip-on-not-found logic — make them safe to run in bulk during offboarding or access reviews.

#PowerShell #ExchangeOnline #Microsoft365 #M365Admin #MicrosoftTeams #M365Groups #DistributionGroups #SecurityGroups #ITAdmin #CloudAdmin #Office365 #M365 #PowerShellAutomation #ExchangeAdmin