Group Membership Copy

Give the new starter exactly what the leaver had.

Type two email addresses. It reads every group the first person belongs to and adds the second person to all of them — Microsoft 365 groups, security groups, distribution lists and mail-enabled security groups — then hands you a report of what it did. The groups it cannot do by itself are listed first, each with the reason, so nothing is quietly missed.

Download the tool ZIP · 11 KB · v1.0.2 · two files, extracts to a version-stamped folder

Running it

Unzip anywhere.
Double-click Copy-GroupMemberships.cmd — not the .ps1. Windows will not run a PowerShell script on a double-click, so the launcher starts it properly.
Sign in twice when asked: once to Microsoft 365, once to Exchange Online. Both are Microsoft’s own sign-in windows.
Type the donor address (copy groups FROM) and the receiver address (copy groups TO).
Watch it work. The report opens by itself when it finishes.

On first run it installs four PowerShell modules for your user account only, and tells you before it starts because that part is slow. Nothing needs administrator rights on the machine.

This one changes your tenant. Unlike the scanner, this tool writes — it adds a real person to real groups, and that takes effect immediately. Check both addresses before you press enter; the tool validates them up front and stops on a typo rather than halfway through, but it cannot know you meant a different Sarah.

It only ever adds. It never removes anybody from anything, and it never touches the donor’s own memberships — so a leaver keeps their access until you remove it deliberately, elsewhere.

What it handles, and how

Each group is routed by what it is, read up front — not by what an error message said afterwards. That distinction is the whole reason the distribution lists work:

Group type	What happens
Microsoft 365 (Unified)	Added through Microsoft Graph
Cloud security group	Added through Microsoft Graph
Distribution list	Added through Exchange Online
Mail-enabled security	Added through Exchange Online
Dynamic	Skipped — membership comes from a rule, so edit the rule
Synced from on-prem AD	Skipped — add the member in local Active Directory
Role-assignable	Skipped if your admin account lacks Privileged Role Administrator

Anything already shared is detected by looking up the receiver’s real membership first, so “already a member” means it checked — not that it read a hopeful message off a failure.

What you get at the end

An HTML report that opens itself: added, already a member, and needs attention — with the skipped ones listed first, each carrying a plain-English reason and what to do about it.
A CSV of the same rows, for a ticket or a handover note.

Both land next to the script, stamped with the date and time of the run.

What it asks to be allowed

Graph permissions GroupMember.ReadWrite.All and User.Read.All, plus a normal Exchange Online admin sign-in. Nothing is registered in your tenant — it signs in through Microsoft’s own tools. Delete the folder afterwards and nothing of it remains on the machine.

If the frame draws as garbage. On an old console with a raster font the box characters can come out as symbols. Set GC_ASCII=1 and run it again for a plain-text frame that works everywhere. The tool itself behaves identically.

DigiCave · Tech Tools