SharePoint: Sites.FullControl.All (certificate PnP)
User.Read.All
— application permissions, granted to the app registration with admin consent.
Licence: None.
Endpoints:
Get-PnPTenantSite · Get-PnPSiteCollectionAdmin (per site)
Users who are site collection admin on fewer than 10 sites are not listed individually unless they are guests or disabled.
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
Site Collection Administrators Sprawl
Site collection administrators bypass every permission in a site and can grant access to anyone. Over the years admins, helpdesk staff, leavers and guests collect this right on hundreds of sites. This scan finds the holders that matter: guests, disabled accounts, broad claims and accounts that are admin almost everywhere.
Press Run scan to read the site collection admins of every site.