Full control user report

[pratheep-r]

I am looking to produce report of full control users. Here is the code

$SiteURL = "Site"
$Connection = Connect-PnPOnline -Url $SiteURL -Credentials $Creds -ReturnConnection
$site = Get-PnPSite -Connection $Connection -Includes RootWeb.RoleAssignments
$RoleAssignments = $site.RootWeb.RoleAssignments

Function Get-ObjectID($LoginName){
    $GroupID = $LoginName
    $GroupID = $GroupID -replace ('_o', '')
    $GroupID = $GroupID -replace ('c:0o.c|federateddirectoryclaimprovider|', '')
    $GroupID = $GroupID -replace ('c:0t.c|tenant|', '')
    $GroupID = $GroupID.Trim('|')

    Return $GroupID
}

Function Get-GroupUsers($LoginName){
    # Get Group Owners
    Try{
        If($LoginName -clike '*_o'){
            $GroupID = Get-ObjectID -LoginName $LoginName
            $GroupUsers = Get-PnPMicrosoft365GroupOwner -Identity $GroupID -Connection $Connection
        }
        # Get Group Members
        Else{
            $GroupID = Get-ObjectID -LoginName $LoginName
            $GroupUsers = Get-PnPMicrosoft365GroupMember -Identity $GroupID -Connection $Connection
        }
    }
    Catch{
        Clear-Variable -Name GroupUsers
    }
    Return $GroupUsers 
}

foreach ($Role in $RoleAssignments){
    #Member property returns the group associated to the web 
    #RoleDefinitionBindings property returns the permissions associated to the group
    Get-PnPProperty -ClientObject $Role -Property RoleDefinitionBindings, Member -Connection $Connection
    $SitePermissionLevels = $Role.RoleDefinitionBindings | Where-Object {$_.Name -eq "Full Control"}
    If($SitePermissionLevels.Length -eq 0 -or $Role.Member.Title -clike '*Limited Access System Group*') {Continue}
    #$Role.Member.Title
    $SitePermssionType = $Role.Member.PrincipalType

    if ($SitePermssionType -eq "SharePointGroup") {
        $GroupMembers = Get-PnPGroupMember -Identity $Role.Member.Title -Connection $Connection
        $GroupMembers.PrincipalType
        
        foreach ($GroupMember in $GroupMembers){
            
            if ($GroupMember.Title -eq "Everyone" -or $GroupMember.Title -eq "Everyone except external users") {Continiue}

            if ($GroupMember.PrincipalType -eq "SecurityGroup") {
                Write-host -ForegroundColor Cyan 'Checking SharePoint Group'$Role.Member.Title '## Security Group ##' $GroupMember.Title '##' $GroupMember.LoginName

                $GroupUsers = Get-GroupUsers -LoginName $GroupMember.LoginName 
                $GroupUsers
            }
            Else  {
                $Users = $GroupMembers.Title
                foreach($user in $Users){
                    $user
                }
            }
        }
    }

    else {
        $DirectUsers = $role.Member.Title
        $DirectUsers
    }
}

I have two M365 groups inside the "Full Control" SharePoint Group. Script pulls up the users in M365 groups, which is fine.

However from this else part,

Else  {
                $Users = $GroupMembers.Title
                foreach($user in $Users){
                    $user
                }
            }

It also brings up M365 group names. I expected only "User" PrincipalType to populate. Please see the output below,

How to NOT include M365 Group names please?
Appreciate any suggestions/help.

[pratheep-r]

Just to add, I also tried "If" condition as below,
if ($GroupMember.PrincipalType -eq "User") {code}