What it works with
Module: PnP.PowerShell
Context: PowerShell 7.4+ · SharePoint Online · PnP.PowerShell
Compatibility: PowerShell 7.4+ is required by current PnP.PowerShell releases.
POWERSHELL / SHAREPOINT
FreeIntermediateRead-onlylow
Export SharePoint groups and members
Exports SharePoint site groups and the direct member principals returned for each group, with explicit empty-group and partial-failure reporting.
Generated locally in your browser · Runs in your PowerShell environment · Review before running
What this PowerShell script does
Exports SharePoint site groups and the direct member principals returned for each group, with explicit empty-group and partial-failure reporting.
Requirements
- Scope - Choose one SharePoint site or a CSV containing a SiteUrl column.
- SharePoint site URL - Required for single-site scope.
- Site list CSV path - CSV must contain a SiteUrl column. Duplicate URLs are ignored.
- Entra app client ID - Your PnP app client ID. Leave empty only when a PnP default client ID is already configured.
- CSV output path - Use a new absolute Windows CSV path.
Environment
- Module: PnP.PowerShell
- Runtime: 7.4+
- Authentication: Interactive PnP login with your own Entra app/client ID or configured default
- Permissions: AllSites.Read
- Risk: Low
Review before you run The generated script is read-only, but authentication and access requirements still apply in your tenant.
OPS / WORKSPACE
Ready to generate
Configure Export SharePoint groups and members in the Builder, review the generated PowerShell and run it in your own environment.
When to use this template
Reports SharePoint groups and their direct members. A member that represents an Entra or Microsoft 365 group remains one principal; Opselith does not silently recurse into directory membership.
Important limitations
- Reports SharePoint groups, not Entra/Microsoft 365 group membership trees.
- Nested/directory group membership is not recursively expanded.
- Permissions assigned directly to users or items are outside this script's scope.
PowerShell and PnP requirements
Current PnP.PowerShell releases require PowerShell 7.4 or later. Interactive authentication requires your own Entra application/client ID, or a default client ID that you have configured for PnP.PowerShell. Opselith does not connect to SharePoint or run the script on your behalf.
Generate the script
- Open the template in the PowerShell Builder.
- Enter the requested URLs, client ID (when needed) and a new CSV output path.
- Generate the script, review its permissions and commands, then run it in your own PowerShell environment.
OPS / SCRIPT DETAILS
Script details
Exports SharePoint site groups and the direct member principals returned for each group, with explicit empty-group and partial-failure reporting. Review these details before generating or running the script.
Permissions and impact
Permissions: AllSites.Read
Risk: Low
Execution impact: Read-only. The script reads SharePoint site groups and direct principals returned as their members; it does not change membership or recursively expand Entra groups.
Parameters
- Scope - Choose one SharePoint site or a CSV containing a SiteUrl column.
- SharePoint site URL - Required for single-site scope.
- Site list CSV path - CSV must contain a SiteUrl column. Duplicate URLs are ignored.
- Entra app client ID - Your PnP app client ID. Leave empty only when a PnP default client ID is already configured.
- CSV output path - Use a new absolute Windows CSV path.
Output
Output: CSV report with SiteUrl, GroupId, GroupTitle, OwnerTitle, MemberLoginName, MemberDisplayName, MemberEmail, PrincipalType, Status and Error.
This template is available in the free library and is generated locally in your browser.
Example use
Exports SharePoint site groups and the direct member principals returned for each group, with explicit empty-group and partial-failure reporting.
Enter the required values in the Builder, review the generated script and confirm the output before running it.
Before you run: Use PowerShell 7.4+ with PnP.PowerShell and interactive authentication. Select one site or a SiteUrl CSV and choose a new CSV output path. Review that this reports SharePoint groups, not Microsoft 365/Entra group membership expansion.
Opselith quality checks
- Included in the current Opselith PowerShell quality suite
- SharePoint groups are clearly distinguished from Entra/Microsoft 365 groups
- No recursive directory-group expansion
- Per-site and per-group failures are isolated
- Empty groups remain visible in the result
Was this useful?One click. No email.