30-second answer

PowerShell
$site = Get-PnPSite -Includes GroupId
$site.GroupId -ne [guid]::Empty

An empty GUID (00000000-0000-0000-0000-000000000000) means no group. Any other value is the group's id in Entra ID.

What this proves

Whether this site is connected to a Microsoft 365 group, from the site itself, with no administrative rights required.

What it does not prove

  • Whether Teams is on top of the group. IsTeamsConnected lives on the tenant record (Get-PnPTenantSite), not on the site, and reading it needs the admin-centre connection. Every Teams-connected site is group-connected, so GroupId answers the weaker question without it.
  • Who is in the group. Membership and ownership are directory questions; the site knows the id and nothing else.

PowerShell

PowerShell
$site = Get-PnPSite -Includes GroupId
if ($site.GroupId -ne [guid]::Empty) {
    "Group-connected: {0}" -f $site.GroupId
} else {
    "Not group-connected"
}

Example output

Text
Group-connected: 7c9a1f2e-3b44-4d05-9f21-6ea8c0d13b77

Explanation

The sentinel matters: GroupId always returns a value, and the empty GUID is the product's way of saying none. Test against [guid]::Empty rather than against null. On a real tenant of 47 readable sites, 22 were group-connected, and the distinction drives governance: a group-connected site's privacy and guest access are group settings, controllable by a sensitivity label, and a site without a group has neither.

Production considerations

  • Site read access is enough; this is one of the few tenant-shape questions a delegated identity can answer site by site.
  • For a whole-tenant view in one call, Get-PnPTenantSite also carries GroupId, at the price of the admin-centre connection.
  • After a device-code login, PnP refuses to switch to the administration context; plan the connection you need before authenticating.
  • SPO-CLASS-003: a group-connected site with no sensitivity label

References

Found something wrong? Suggest a correction. The article source is not public; the engine it cites is.

What this answer underwrites

The engine reads these Microsoft operations to collect evidence, so what is established here is what those collectors rest on.

  • activitywhen a person last changed something on one site
  • classificationwhat a site records about the kind of content it holds
  • sharingwhat one site permits, and its default link
  • sitesevery site this identity can enumerate