Transitive membership is membership in a group through any chain of nesting, rather than by direct addition. If a user is in group C, C is in B, and B is in A, the user is a transitive member of both B and A, and inherits what they grant.
Direct versus transitive#
Direct membership is the edge an administrator created; transitive membership is the closure of all such edges. Most access decisions operate on the transitive set, while some features deliberately do not: group-based licensing, notably, applies only to direct members. That split is why the directory's real behavior can differ so much from what any one list suggests.
Microsoft Graph exposes both views, and the difference between a user's direct and transitive membership counts is a quick measure of how much structure sits between people and their access.
Get-MgUserMemberOf -UserId user@contoso.com # direct
Get-MgUserTransitiveMemberOf -UserId user@contoso.com # effectiveVisualizerEngine
Transitive membership in VisualizerEngine
The hierarchy and graph views make the transitive set visible as paths instead of a flat list: zoom from the tenant to a single user and see every chain they sit on. Members are typed correctly during sync, so users, devices, nested groups, service principals, and contacts are never conflated.