az ad group member list returns empty for security groups containing only service principals

[daravi]

Describe the bug

az ad group member list returns empty results for a security group whose members are service principals (managed identities), while the Azure portal correctly shows the members when logged in with the same identity and tenant.

Steps to reproduce

1. Login to the tenant where the security group exists:

   az login --tenant <tenant-id>

2. Verify the group exists and is accessible:

   az ad group show --group "<group-name>"
   # Returns successfully with group metadata (displayName, id, description)

3. List group members:

   az ad group member list --group "<group-name>" --query "[].{displayName:displayName, id:id}" -o table
   # Returns empty - no output

4. Open Azure portal (portal.azure.com), switch to the same directory, navigate to the same group → Members tab → shows the correct members (service principals)

Expected behavior

az ad group member list should return the same members that the Azure portal shows.

Actual behavior

The CLI returns empty results while the portal shows members correctly. Both use the same user identity and the same tenant.

Additional context

• The security group only contains service principal members (user-assigned managed identities), not user accounts
• az ad group show works correctly for this group
• The account used is a guest account in the target tenant
• Regular security groups with user members work fine with az ad group member list

Environment

• OS: Windows 11 Enterprise
• Shell: bash (Git Bash)
• Azure CLI: 2.x (latest)

[yonzhan]

Thank you for opening this issue, we will look into it.

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• Service principals are not returned by az ad group member list #32774
• az ad group member list does not list service principals #22664

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Use the beta API endpoint as a workaround to retrieve service principal members of a group. You can use the following command:

GROUP_ID="GROUP_UUID"
az rest \
  --method get \
  --url https://graph.microsoft.com/beta/groups/$GROUP_ID/members |\
   jq '.value[] | select(.["@odata.type"] == "#microsoft.graph.servicePrincipal") | .id'

Reference:

• az ad group member list does not list service principals #22664 (comment)
• az ad group member list does not list service principals #22664 (comment)
• az ad group member list does not list service principals #22664 (comment)

Powered by issue-sentinel

[daravi]

Closing as duplicate of #22664. Same behavior — az ad group member list returns empty for groups containing only service principals, while Azure portal shows them correctly.