Reports the memberships of the Owners, Members, and Visitors groups of SharePoint Online sites. This example further filters the results to only show sites with any group containing the EEEU claim

Get-SharePointSiteGroupMembers.ps1

function Get-SiteId
{
    [CmdletBinding()]
    param
    (
        [Parameter(Mandatory=$true)]
        [System.Uri]
        $SiteUrl
    )

    begin
    {
        $context = Get-PnPContext
        $tenant  = New-Object Microsoft.Online.SharePoint.TenantAdministration.Tenant($context)
    }
    process
    {
        return [Microsoft.SharePoint.Client.TenantExtensions]::GetSiteGuidByUrl($tenant, $SiteUrl)
    }
    end
    {
    }
}

function Get-SharePointGroupMember
{
    [CmdletBinding()]
    param
    (
        [Parameter(Mandatory=$true)]
        [System.Uri]
        $SiteUrl,

        [Parameter(Mandatory=$false)]
        [switch]
        $OwnersGroup,

        [Parameter(Mandatory=$false)]
        [switch]
        $MembersGroup,

        [Parameter(Mandatory=$false)]
        [switch]
        $VisitorsGroup
    )

    begin
    {
        $userGroupIds = @()

        if( $OwnersGroup.IsPresent )
        {
            $userGroupIds += 0
        }

        if( $MembersGroup.IsPresent )
        {
            $userGroupIds += 1
        }

        if( $VisitorsGroup.IsPresent )
        {
            $userGroupIds += 2
        }

        $siteId = Get-SiteId -SiteUrl $SiteUrl

        $url = "/_api/SPO.Tenant/sites/GetSiteUserGroups?siteId='{0}'&userGroupIds=[{1}]" -f $siteId.ToString(), ($userGroupIds -join ",").ToString()
    }
    process
    {
        if( $userGroupIds.Count -eq 0 )
        {
            throw "The OwnerGroup, MemberGroup or VistorGroup must be supplied." 
        }

        $response = Invoke-PnPSPRestMethod -Method Get -Url $url -ErrorAction Stop
        
        $result = [PSCustomObject] @{ SiteUrl = $SiteUrl }

        if( $OwnersGroup.IsPresent )
        {
            $result | Add-Member -MemberType NoteProperty -Name "OwnersGroupMembers" -Value $response.value[0].userGroup.loginName
        }

        if( $MembersGroup.IsPresent )
        {
            $result | Add-Member -MemberType NoteProperty -Name "MembersGroupMembers" -Value $response.value[1].userGroup.loginName
        }

        if( $VisitorsGroup.IsPresent )
        {
            $result | Add-Member -MemberType NoteProperty -Name "VisitorsGroupMembers" -Value $response.value[2].userGroup.loginName
        }

        return $result
    }
    end
    {
    }
}

# connect to tenant admin site

    Connect-PnPOnline `
                -Url         "https://$env:O365_TENANT-admin.sharepoint.com" `
                -ClientId    $env:O365_CLIENTID `
                -Thumbprint  $env:O365_THUMBPRINT `
                -Tenant      $env:O365_TENANTID `
                -ErrorAction Stop

# get all unlocked spo sites

    $siteUrls = Get-PnPTenantSite -Filter "LockState -eq 'Unlock'" | Select-Object -ExpandProperty Url

# scan each site

    $timestamp = Get-Date -Format FileDateTime

    foreach( $siteUrl in $siteUrls )
    {
        Write-Host "[$(Get-Date)] - Scanning site: $siteUrl"

        $ownersGroupContainsEEEU = $membersGroupContainsEEEU = $visitorsGroupContainsEEEU = $false

        try
        {
            $memberships = Get-SharePointGroupMember -SiteUrl $siteUrl -OwnersGroup -MembersGroup -VisitorsGroup -ErrorAction Stop

            if( $memberships.OwnersGroupMembers | Where-Object -FilterScript { $_ -match "spo-grid-all-users" } )
            {
                $ownersGroupContainsEEEU = $true
            }

            if( $memberships.MembersGroupMembers | Where-Object -FilterScript { $_ -match "spo-grid-all-users" } )
            {
                $membersGroupContainsEEEU = $true
            }

            if( $memberships.VisitorsGroupMembers | Where-Object -FilterScript { $_ -match "spo-grid-all-users" } )
            {
                $visitorsGroupContainsEEEU = $true
            }

            # only include the result if at least one site group contains EEEU
            if( $ownersGroupContainsEEEU -or $membersGroupContainsEEEU -or $visitorsGroupContainsEEEU )
            {
                $result = [PSCustomObject] @{
                              SiteUrl      = $memberships.SiteUrl
                              OwnersGroup  = $ownersGroupContainsEEEU
                              MembersGroup = $membersGroupContainsEEEU
                              VistorsGroup = $visitorsGroupContainsEEEU
                          }

                $result | Export-Csv -Path "SharePointGroupEEEUScanResults_$timestamp.csv" -NoTypeInformation -Append
            }
        }
        catch
        {
            Write-Error "Failed to scan site: $siteUrl. Error: $_"
        }
    }