SharePoint: Sites.FullControl.All (application, certificate)
— application permission, granted to the app registration with admin consent.
Endpoints:
Get-PnPTenant · Get-PnPTenantSite -Detailed
Site rows only appear for sites that allow Anyone links and override the tenant's default link type or Anyone link expiry. Library-, folder- and file-level sharing is not read.
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
SharePoint & OneDrive Sharing Posture
How far can content travel? The tenant-wide sharing level, what the share dialog suggests by default, whether Anyone links expire, what unmanaged devices can do - and the sites that loosen those defaults with their own settings.