The portal exports groups as a flat list, which destroys the one thing an architecture review or audit actually needs: the nesting relationships. A real hierarchy export has to preserve parent-child structure, membership types, and the license assignments attached along the way.
The flat export problem#
A flat CSV of group names answers almost nothing. Reviewers ask which groups contain which, how deep the chains go, and where the licenses sit. Reconstructing that from a flat list means joining membership queries per group, at which point you are writing a recursive exporter.
A recursive PowerShell exporter#
The skeleton walks group members and records edges with types:
Connect-MgGraph -Scopes "Group.Read.All"
$edges = foreach ($g in Get-MgGroup -All) {
foreach ($m in Get-MgGroupMemberAsGroup -GroupId $g.Id) {
[pscustomobject]@{ Parent = $g.DisplayName; Child = $m.DisplayName }
}
}
$edges | Export-Csv hierarchy-edges.csv -NoTypeInformationWhat the script version cannot give you#
An edge list is data, not a picture, and it goes stale the moment it is exported. Audiences also differ: auditors want provenance on the file, executives want an image, engineers want JSON. Maintaining all of that by hand is a recurring cost.
VisualizerEngine
How VisualizerEngine does it
Exports are built in for every audience: CSV and JSON of the full hierarchy and analytics, PDF reports with your own branding, and PNG or SVG images of any visualization. Compliance exports carry provenance metadata and an integrity trailer, so a report handed to an auditor can be traced back to the exact data that produced it.