SharePoint: Sites.FullControl.All (application, certificate)
User.Read.All
— application permissions, granted to the app registration with admin consent.
Endpoints:
Get-PnPTenant (OrphanedPersonalSitesRetentionPeriod) · Get-PnPTenantSite -IncludeOneDriveSites · GET /v1.0/users · GET /v1.0/directory/deletedItems/microsoft.graph.user
Retention or litigation holds (Microsoft Purview) keep a OneDrive beyond the date shown. Users deleted longer ago than the Entra 30-day recycle bin are no longer in the directory - they show as 'Owner not in the directory'.
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
Orphaned OneDrives of Leavers
When a user is deleted, their OneDrive is kept for the retention period (30 days by default) and then deleted - including files nobody else has a copy of. Disabled accounts whose OneDrive is still full, and deleted ones about to run out of retention, are listed so someone can move what the business still needs.