Get SharePoint Online Team 0365 Site Owners

[Adhanj]

I am trying to get SharePoint Online site owners for service desk team. Looking for community to review the script and provide recommendation/suggestions.

I am not sure if Get-PnPAzureADGroupMember is recursive i.e. it gets user in nested groups. If not what I can do to get users from nested groups.

Function Get-SiteConnection { Param( [Parameter(Mandatory = $true, Position = 0)] [string]$Url ) $ClientID = "<MyClientID>" $CertPath = "<CertPath>" $CertPass = "<CertPassword>" $Password = (ConvertTo-SecureString -AsPlainText $CertPass -Force) $AadDomain = "<My AadDomain>" Connect-PnPOnline -Url $Url -ClientId $ClientID -CertificatePath $CertPath -CertificatePassword $Password -Tenant $AadDomain }

`Function Get-SPUsers
{
Param(
[Parameter(Mandatory = $true, Position = 0)]
$Members
)
$Emails = @()
Foreach ($Member in $Members)
{

    if ($Member.Title -in $filterUsers) {
        break;
    }

    Switch ($Member.PrincipalType)
    {
        "User" { 
            $str = $Member.LoginName.ToString()
            $Emails += $str.Substring($str.LastIndexOf("|")+1)
        }
        "SecurityGroup" {
            if ($Member.LoginName -like "c:0t.c*") {
                Get-PnPAzureADGroupMember -Identity $Member.Title -ErrorAction SilentlyContinue | 
                ForEach-Object {
                    $Emails += $_.UserPrincipalName.ToString()
                }
            }
            elseif ($Member.LoginName -like "c:0o.c*") {
                $str =  $Member.LoginName.ToString()
                $o365 = $str.Replace("_o","").Substring($str.LastIndexOf("|")+1)
                Get-PnPMicrosoft365Group -Identity $o365 -IncludeOwners -ErrorAction SilentlyContinue | 
                Select-Object -ExpandProperty Owners |
                Where-Object {$_.DisplayName -notlike "Commvault*"} |
                ForEach-Object {
                    $Emails += $_.UserPrincipalName.ToString()
                }
            }
        }
        "SharePointGroup" {
            Get-PnPGroupMember -Group $Member.Title -ErrorAction SilentlyContinue | 
            Where-Object {$_.Title -ne "System Account"} | 
            Select-Object Title,LoginName,PrincipalType |
            ForEach-Object {
                If ($_.PrincipalType -ne "User") {
                    Get-SPUsers $_
                }
                else {
                    $str = $_.LoginName.ToString()
                    $Emails += $str.Substring($str.LastIndexOf("|")+1)
                }
            }
        }
    }
}
return $Emails

}`

`Function Get-SiteOwners {
Param(
[Parameter(Mandatory = $false, Position = 0)]
$IsSubsite = $false
)
$Users = @()

Get-PnPUser -WithRightsAssigned -ErrorAction SilentlyContinue | 
   Where-Object{$_.IsSiteAdmin -eq $true} | 
    ForEach-Object {
        $Users += [pscustomobject]@{
            Title = $_.Title
            LoginName = $_.LoginName
            PrincipalType = $_.PrincipalType
        }
    }

if ($IsSubsite) {
    Get-PnpSiteCollectionAdmin -ErrorAction SilentlyContinue | 
        ForEach-Object {
            $Users += [pscustomobject]@{
                Title = $_.Title
                LoginName = $_.LoginName
                PrincipalType = $_.PrincipalType
            }
        }
}
Get-PnPGroup -Includes Title,LoginName,PrincipalType -ErrorAction SilentlyContinue | 
    Where-Object { $_.Title -notlike "SharingLinks.*" -and $_.Title -notlike "Limited Access*" } |
    ForEach-Object {
        $GroupPermission = Get-PnPGroupPermissions -Identity $_.Title -ErrorAction SilentlyContinue | Where-Object { $_.Hidden -like "False" } 
        If ($GroupPermission.RoleTypeKind -eq "Administrator") {
            $Users += [pscustomobject]@{
                Title = $_.Title
                LoginName = $_.LoginName
                PrincipalType = $_.PrincipalType
            }
        }
    }

$Web = Get-PnPWeb -ErrorAction SilentlyContinue
$RAS = Get-PnPProperty -ClientObject $Web -Property RoleAssignments
ForEach ($RA in $RAS) {
    $RoleBindings = Get-PnPProperty -ClientObject $RA -Property RoleDefinitionBindings
    Foreach ($Rb in $RoleBindings)
    {
        If (($Rb.RoleTypeKind).ToString() -eq "Administrator") {
            Get-PnPProperty -ClientObject $($RA.Member) -Property Title,LoginName,PrincipalType 
            $RA.Member | Select-Object Title,LoginName,PrincipalType |
            ForEach-Object {
                $Users += [pscustomobject]@{
                    Title = $_.Title
                    LoginName = $_.LoginName
                    PrincipalType = $_.PrincipalType
                }
            }
        }
    }
}
return $Users |Sort-Object -Property Title -Unique | Where-Object {$_.Title -notin $filterUsers} | ForEach-Object {Get-SPUsers -Members $_}

}`

Function Add-SiteOwnerListItem { Param($Title,$Url,$IsSubsite,$Owners) Get-SiteConnection -Url '<MySite>' $list = 'SiteOwners' Add-PnPListItem -List $list -Values @{"Title"=$Title;"SubSite"=$IsSubsite;"SiteUrl"="$Url, $Url";"SiteOwners"=$Owners} Disconnect-PnPOnline }

`$filterUsers =
$Sites =

Foreach ($Site in $Sites) {
Get-SiteConnection -Url $Site.Url
Write-Host "Processing Site:$($Site.Url)"
$Owners = Get-SiteOwners -IsSubSite $Site.IsSubSite

Write-Host "Writing Line" $Site.Title,$Site.Url,$Site.IsSubSite,$(($Owners | Sort-Object -Unique) -join ",")
Add-SiteOwnerListItem -Title $Site.Title -Url $Site.Url -IsSubsite $Site.IsSubSite -Owners $Owners | Sort-Object -Unique

$SubSites = Get-PnpSubwebs -Recurse -Includes HasUniqueRoleAssignments | Where-Object {$_.HasUniqueRoleAssignments -eq $true} | Select-Object Title, Url,@{ Name = 'IsSubSite'; Expression = {$true}} 
Disconnect-PnPOnline
ForEach ($SubSite in $SubSites) {
    Get-SiteConnection -Url $SubSite.Url
    Write-Host "Processing Site:$($SubSite.Url)"
    $Owners = Get-SiteOwners -IsSubSite $SubSite.IsSubSite
    Write-Host "Writing Line" $SubSite.Title,$SubSite.Url,$SubSite.IsSubSite,$(($Owners | Sort-Object -Unique) -join ",")
    Add-SiteOwnerListItem -Title $SubSites.Title -Url $SubSites.Url -IsSubsite $SubSites.IsSubSite -Owners $Owners | Sort-Object -Unique        

Disconnect-PnPOnline
}
}`