How to detect Microsoft 365 group-connected SharePoint sites
Is this site connected to a Microsoft 365 group?
30-second answer
$site = Get-PnPSite -Includes GroupId
$site.GroupId -ne [guid]::Empty
An empty GUID (00000000-0000-0000-0000-000000000000) means no group. Any
other value is the group's id in Entra ID.
What this proves
Whether this site is connected to a Microsoft 365 group, from the site itself, with no administrative rights required.
What it does not prove
- Whether Teams is on top of the group.
IsTeamsConnectedlives on the tenant record (Get-PnPTenantSite), not on the site, and reading it needs the admin-centre connection. Every Teams-connected site is group-connected, soGroupIdanswers the weaker question without it. - Who is in the group. Membership and ownership are directory questions; the site knows the id and nothing else.
PowerShell
$site = Get-PnPSite -Includes GroupId
if ($site.GroupId -ne [guid]::Empty) {
"Group-connected: {0}" -f $site.GroupId
} else {
"Not group-connected"
}
Example output
Group-connected: 7c9a1f2e-3b44-4d05-9f21-6ea8c0d13b77
Explanation
The sentinel matters: GroupId always returns a value, and the empty GUID
is the product's way of saying none. Test against [guid]::Empty rather
than against null. On a real tenant of 47 readable sites, 22 were
group-connected, and the distinction drives governance: a group-connected
site's privacy and guest access are group settings, controllable by a
sensitivity label, and a site without a group has neither.
Production considerations
- Site read access is enough; this is one of the few tenant-shape questions a delegated identity can answer site by site.
- For a whole-tenant view in one call,
Get-PnPTenantSitealso carriesGroupId, at the price of the admin-centre connection. - After a device-code login, PnP refuses to switch to the administration context; plan the connection you need before authenticating.
References
- Overview of Microsoft 365 groups (Microsoft Learn)
- Get-PnPSite (PnP PowerShell)
