All Mail-Enabled Security Groups

The question it answers: Which mail-enabled security groups exist, with their primary address and number of direct members?

Note

Member Count = direct members from Get-DistributionGroupMember -ResultSize Unlimited (all members, nested groups count as one member), one call per group, so large tenants take a while.

At a glance

Where in the app	Entra ID › Groups › Mail-enabled Security
Workload	Entra ID
Kind	Table
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	Exchange Online.
Report id (API and MCP)	entra.groups.mail-enabled-security

Columns

Column	Key	Type
Display Name	DisplayName	Text
Primary Address	Mail	Text
Member Count	MemberCount	Text

What it needs

Licence: Exchange Online.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Exchange.ManageAsApp	Office 365 Exchange Online	Manage Exchange As Application	+ View-Only Recipients

Data sources it reads

• PowerShell: Get-DistributionGroup -RecipientTypeDetails MailUniversalSecurityGroup -ResultSize Unlimited
• PowerShell: Get-DistributionGroupMember -ResultSize Unlimited (per group)

Through the API and MCP

GET /ir-api/v1/reports/entra.groups.mail-enabled-security?size=100

An AI assistant reads it with the MCP tool get_report and the id entra.groups.mail-enabled-security. The client needs the Read grant for Entra ID. See Using the API.