Description:

This step retrieves the members of a Microsoft Entra ID group.

The List Group Members workflow step connects to Microsoft Entra ID (formerly Azure Active Directory) to retrieve users who belong to a specified security group or Microsoft 365 group.

Optionally, the step can recursively retrieve members from nested groups, allowing workflows to process complete group hierarchies.

The retrieved member information is stored in a FlowWright variable or global variable, enabling subsequent workflow steps to process, filter, or iterate through the group membership collection.

The step supports:

• Microsoft Entra ID group member retrieval
• Configurable Entra ID connections
• Recursive retrieval of nested group members
• Storage of member collections in workflow variables
• Integration with Microsoft Graph through FlowWright connections

This step can be used for:

• Security group audits
• Access reviews
• Membership reporting
• User provisioning validation
• Compliance reporting
• Identity lifecycle management
• Business process automation

Usage:

The List Group Members step is typically placed at the beginning of a workflow that needs to process or report on the members of a Microsoft Entra ID group.

The workflow stores the retrieved member collection in the specified workflow variable or global variable.

Once the members have been retrieved, later workflow steps can:

• Iterate through the member collection
• Generate membership reports
• Perform security and compliance audits
• Validate user access
• Synchronize external systems
• Execute bulk identity management operations

You need to set up an EntraID connection. Go to Integration > Connections > Generic Connections. On the Manage Generic Connections page, click Actions > Create. A sample connection is included here for reference. 

Example:

Let’s build and execute the “clsGetEntraIDGroupMembersDef” example:

• Create a new process definition named “clsGetEntraIDGroupMembersDef” and open it in designer mode. 
• Drag a “clsGetEntraIDGroupMembers” step to the canvas.
• Connect the dots between the “Start” and “clsGetEntraIDGroupMembers” steps.
• Define a variable or a global to store the group members' results.
• Click the "clsGetEntraIDGroupMembers" step to configure its "Required" properties. Provide a name for the step. Select the EntraID connection from the drop-down list. Enter the “Group Name”. Provide the variable or global reference. Click the Save button. Note: Click the "AI Predict" button to have the Copilot add new process steps that match your process description. 

• Click the "clsGetEntraIDGroupMembers" step to configure its "Optional" properties. Select “Yes” for Recursive to fetch subgroups. Click the Save button. 

• The “Logging” configuration is necessary for documentation and also measures workflow progress and percent complete. This is achieved by configuring the step state and percent fields individually, as shown below. Configure the “Logging” using the following properties.

• Save the Process Definition. Create a new Process Instance and execute it. When the workflow reaches the List Group Members step, FlowWright connects to the configured Microsoft Entra ID tenant and retrieves the members of the specified group. If Recursive is enabled, members of nested groups are also included in the returned collection. The complete member collection is stored in the specified workflow variable or global variable. If the group members are successfully retrieved, the workflow follows the True return path. If the group cannot be found, the connection cannot be established, or the member information cannot be retrieved, the workflow follows the False return path.

Tips:

• Verify that the Microsoft Entra ID connection has been configured before using this step.
• Enable Recursive only when nested group memberships are required, as retrieving nested memberships may increase execution time.
• Store the returned member collection in a workflow variable that can be referenced by subsequent workflow steps.
• Use the returned data together with For Each or collection-processing steps to perform bulk operations on group members.
• Use this step when generating membership reports or validating user access.
• Use the True and False return paths to implement appropriate success and error handling.
• Combine this step with user provisioning, group management, or reporting steps to automate Microsoft Entra ID administration.

Notes:

• A valid Microsoft Entra ID connection must exist before this step can execute.
• The configured connection must have sufficient Microsoft Graph permissions to read group memberships.
• The specified group must already exist in Microsoft Entra ID.
• Enabling Recursive may increase processing time for groups with nested memberships.
• Network connectivity or authentication issues may prevent successful retrieval.
• The workflow should include appropriate error handling for the False return path.

Definition Sample:

You may download the sample definition(s) from the link provided and later import them (drag-and-drop) into your FlowWright Process Definition (XML file) or Form Definition (HTML file) page.

Note: Verify and complete any missing configuration after importing the sample, including:

• Microsoft Entra ID connection
• Group name mapping
• Recursive option
• Output variable mapping
• Workflow variable mappings
• Microsoft Graph permissions
• Environment-specific settings

After verifying the configuration, save the Process Definition before execution.

Click here to download the sample file.