Get All SharePoint Online Users and Groups with “Full Control” (Owner) Permissions using PowerShell

#Set Parameters
$AdminCenterURL="https://crescent-admin.sharepoint.com"
$SiteUrl = "https://crescent.sharepoint.com/sites/oncology"

#Connect to SharePoint Online
Connect-SPOService -Url $AdminCenterURL -credential (Get-Credential)

 #Get all Groups from the site
$SiteGroups = Get-SPOSiteGroup -Site $siteURL

#Get Group info that have "Full Control" Permissions
ForEach ($Group in $SiteGroups)
{
    If($Group.Roles.Contains("Full Control"))
    {
        Write-Host -f Yellow $Group.Title
        #Get each member of the group
        ForEach($User in $Group.Users | Where{$_.contains("@")}) #Exclude system Users
        {
            write-host -f Green $User
        }
    }
} 

#Variables
$AdminCenterURL = "https://crescent-admin.sharepoint.com/"
 
#Connect to SharePoint Online
Connect-SPOService -url $AdminCenterURL -Credential (Get-Credential)
 
#Get all Site collections
$Sites = Get-SPOSite -Limit All

#Loop through site collections
ForEach($Site in $Sites)
{
    Write-host -f Cyan "Searching site: $($Site.URL)"
    #Get all Groups from the site permissions
    $SiteGroups = Get-SPOSiteGroup -Site $Site | Where { $_.Roles -ne $NULL -and $_.Users -ne $NULL}

    #Get Group info and members that have site owners permissions
    ForEach ($Group in $SiteGroups)
    {
        If($Group.Roles.Contains("Full Control"))
        {
            Write-Host -f Yellow $Group.Title
            #Get each member of the group
            ForEach($User in $Group.Users | Where{$_.contains("@")}) #Exclude system Users
            {
                write-host -f Green $User
            }
        }
    }
}

#Parameters
$SiteURL = "https://crescent.sharepoint.com"
$ReportOutput = "C:\Temp\FullControlPermissionRpt.csv"

#Connect to Site
Connect-PnPonline -Url $SiteURL -Interactive
 
#Get the Root web
$Web = Get-PnPWeb -Includes RoleAssignments

#Loop through each permission assigned to the site and extract details
$PermissionData = @()
ForEach ($RoleAssignment in $Web.RoleAssignments)
{
    #Get the Permission Levels assigned and Member
    Get-PnPProperty -ClientObject $RoleAssignment -Property RoleDefinitionBindings, Member
     
    #Check if "Full Control" Permission Level is assigned to the Assignment
    If( ($RoleAssignment.RoleDefinitionBindings | Select -ExpandProperty Name).Contains("Full Control"))
    {
        $PermissionType = $RoleAssignment.Member.PrincipalType
        #Get SharePoint group members
        If($PermissionType -eq "SharePointGroup")
        {
            #Get Group Members
            $GroupMembers = Get-PnPGroupMember -Identity $RoleAssignment.Member.LoginName

            $GroupUsers = ($GroupMembers | Where {$_.LoginName -ne "SHAREPOINT\system"} | Select -ExpandProperty Email) -join "; "
            #Leave Empty Groups - Without users
            If([String]::IsNullOrEmpty($GroupUsers)){ Continue }
   
            #Add the Data to Object
            $Permissions = New-Object PSObject
            $Permissions | Add-Member NoteProperty Name($RoleAssignment.Member.Title)
            $Permissions | Add-Member NoteProperty Accounts($GroupUsers)
            $Permissions | Add-Member NoteProperty Type($PermissionType)
            $PermissionData += $Permissions
        }
        Else
        {
            #Get the User
            $User = Get-PnPUser -Identity $RoleAssignment.Member.LoginName
            #Add the Data to Object
            $Permissions = New-Object PSObject
            $Permissions | Add-Member NoteProperty Name($RoleAssignment.Member.Title)
            $Permissions | Add-Member NoteProperty Accounts($User.Email)
            $Permissions | Add-Member NoteProperty Type($PermissionType)
            $PermissionData += $Permissions
        }
    }
}
#Export Permissions data to CSV file
$PermissionData | Export-csv -path $ReportOutput -NoTypeInformation