Support Required for Remove Assigned Groups form Microsoft Entra Server using Entra Spoke

[NaveenK08632274]

I am working on removing user group memberships from Microsoft Entra server based on the User ID using the Microsoft Entra ID Spoke in ServiceNow.

Currently, i have created custom action executes successfully and returns a successful response. However, the user is not being removed from the groups in Microsoft Entra ID as expected.

As part of my troubleshooting, I created a REST Message named "ServiceNow Microsoft Entra ID" and an HTTP Method called "removeUserIdGroups" to retrieve the user's group memberships from Microsoft Entra ID. Although I receive a 200 OK response, the API is returning only Dynamic Groups and not the Assigned Groups.

I am using the User ID endpoint to retrieve the user's group membership details.

Could someone please help with the following?

• How can I retrieve only the groups with the Assigned membership type?
• Is there a specific Microsoft Entra API endpoint, query parameter, or filter that can be used to exclude Dynamic Groups and return only Assigned Groups?
• Are there any additional permissions or configuration requirements that I should be aware of?

This information will help ensure that the group removal process targets only the required assigned groups and functions correctly.

[kmohammed]

Hi Naveen,

The important point first: a user cannot be removed from a Dynamic group through Microsoft Graph at all. Dynamic membership is calculated from the group's membership rule, so there is no member to delete — that is why targeting those groups will never work, no matter how the call is built. Only Assigned membership groups can be removed via API.

How to separate them:

1. Retrieve memberships with the group properties you need, not just the ID. Use GET /users/{user-id}/memberOf/microsoft.graph.group and select id, displayName, groupTypes and membershipRule (add ConsistencyLevel: eventual header if you use advanced query parameters).

2. Filter in your action/flow after retrieval. A group is Dynamic if membershipRule is not empty, or groupTypes contains DynamicMembership. Everything else returned is Assigned membership. Graph does not give you a reliable server-side switch on the user endpoint that returns "assigned groups only", so do this filtering in your custom action (REST step parsing, or a code step) before you build the removal list.

3. Remove only from the filtered Assigned list: DELETE /groups/{group-id}/members/{user-object-id}/$ref. One call per group.

Permissions and other things to check:

- Reading memberships needs GroupMember.Read.All (or Directory.Read.All); removing members needs GroupMember.ReadWrite.All, with admin consent for application permissions.

- Groups synced from on-premises AD (onPremisesSyncEnabled = true) cannot be managed in Entra ID — membership must be removed in AD, the Graph call will fail for those too.

- Also note Microsoft 365 groups vs security groups do not change the rule above: what matters is Dynamic vs Assigned, which is exactly the membershipRule / groupTypes test.

So the fix is in your retrieval step: pull groupTypes + membershipRule, drop any group where membershipRule is set, and run your existing removal action only against what is left.