List external users across all sites and in what site groups they are
The script shows in what site groups external users are added in all SharePoint Online sites
Summary
This script shows how you can check if external users are added to site groups. It will show all external users across all site collections and the site groups they where added to.

$m365Status = m365 status --output text
if ($m365Status -eq "Logged Out") {
m365 login
}
Write-Host "Retrieving all sites and check external users..." -ForegroundColor Green
$sites = m365 spo site classic list -o json | ConvertFrom-Json
$siteCount = $sites.Count
$siteCounter = 0
$results = [System.Collections.ArrayList]::new()
$spoAccessToken = m365 util accesstoken get --resource sharepoint --new | ConvertFrom-Json
Write-Host "Processing $siteCount sites..."
foreach ($site in $sites) {
$siteCounter++
Write-Host "$siteCounter/$siteCount - Get external users in site groups for $($site.Url)..." -ForegroundColor Green
$response = Invoke-WebRequest -Uri "$($site.Url)/_api/web/siteusers?`$filter=IsShareByEmailGuestUser eq true&`$expand=Groups&`$select=Title,LoginName,Email,Groups/LoginName" -Method Get -Headers @{ Authorization = "Bearer $spoAccessToken"; Accept = "application/json;odata=nometadata" }
$users = $response.Content | ConvertFrom-Json
foreach($user in $users.value) {
foreach($group in $user.Groups) {
$obj = [PSCustomObject][ordered]@{
Title = $user.Title;
Email = $user.Email;
LoginName = $user.LoginName;
Group = $group.LoginName;
}
$results.Add($obj) | Out-Null
}
}
}
Write-Host "Exporting list..." -ForegroundColor Green
$results | Export-Csv -Path "./cli-external-users-in-sitegroups.csv" -NoTypeInformation
Connect-PnPOnline "https://contoso-admin.sharepoint.com" -Interactive
Write-Host "Retrieving all sites and check external users..." -ForegroundColor Green
$sites = Get-PnPTenantSite
$siteCount = $sites.Count
$siteCounter = 0
$results = [System.Collections.ArrayList]::new()
Write-Host "Processing $siteCount sites..."
foreach($site in $sites) {
$siteCounter++
Write-Host "$siteCounter/$siteCount - Get external users in site groups for $($site.Url)..." -ForegroundColor Green
Connect-PnPOnline -Url $site.Url -Interactive
$users = (Invoke-PnPSPRestMethod -Method Get -Url "$($site.Url)/_api/web/siteusers?`$filter=IsShareByEmailGuestUser eq true&`$expand=Groups&`$select=Title,LoginName,Email,Groups/LoginName" -ContentType "application/json;odata=nometadata" -Raw -ErrorAction Ignore | ConvertFrom-Json)
foreach($user in $users.value) {
foreach($group in $user.Groups) {
$obj = [PSCustomObject][ordered]@{
Title = $user.Title;
Email = $user.Email;
LoginName = $user.LoginName;
Group = $group.LoginName;
}
$results.Add($obj) | Out-Null
}
}
}
Write-Host "Exporting list..." -ForegroundColor Green
$results | Export-Csv -Path "./pnp-external-users-in-sitegroups.csv" -NoTypeInformation
Contributors
| Author(s) |
|---|
| Martin Lingstuyl |
| Bart-Jan Dekker |
Disclaimer
THESE SAMPLES ARE PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR NON-INFRINGEMENT.
Tool documentation & references
- Want to learn more about CLI for Microsoft 365 and the commands
Check out the CLI for Microsoft 365 site to get started and for the reference to the commands.
- Want to learn more about PnP PowerShell and the cmdlets
Check out the PnP PowerShell site to get started and for the reference to the cmdlets.