This is an example script that uses the Client Side Object Model (CSOM) in PowerShell to get the "Everyone except external users" Principal.

GetEveryoneExceptExternalUsersPrincipal.ps1

$siteUrl = "https://mysharepointsite.sharepoint.com/sites/subsite"

# Set headers
$headers = @{
    "Authorization"="Bearer ";
}

$authRealm = "";
# Make an invalid request. We will extract the GUID from the Response.
try {
    Invoke-WebRequest $("$siteUrl/_vti_bin/client.svc") -Method POST -Headers $headers
}
catch [exception] {
    # Extract Authentication Realm GUID from Response headers
    $_.Exception.Response.Headers["WWW-Authenticate"] -match '(?<=Bearer realm=")\w+-\w+-\w+-\w+-\w+(?=")'
    $authRealm = $matches[0];
}

$everyoneExceptExternal = "c:0-.f|rolemanager|spo-grid-all-users/$authRealm"
$everyoneExceptExternalPrincipal = $web.EnsureUser($everyoneExceptExternal);
$ctx.Load($everyoneExceptExternalPrincipal);
$ctx.ExecuteQuery();

In line 20, what is the value of $web?