SharePoint: Sites.FullControl.All
— application permission, granted to the app registration with admin consent.
Licence: None. SharePoint Advanced Management adds Microsoft's own data access governance reports, which go deeper than this scan.
Endpoints:
PnP: Get-PnPTenantSite · Get-PnPWeb -Includes RoleAssignments (per site) · Get-PnPGroupMember (per SharePoint group)
This is a SharePoint API permission (not Graph), used by PnP PowerShell with the app's certificate - the same one the existing SharePoint reports use. The scan connects to every site once, so expect several minutes on a large tenant.
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
Copilot Oversharing - Sites Open to the Whole Company
Microsoft 365 Copilot only shows people what they can already open - but it makes that content findable by asking a question. A site that grants Everyone, Everyone except external users or All users is readable by every employee, and Copilot will surface it. This scan checks each site's own permissions and the members of its SharePoint groups. It does not see unique permissions on libraries, folders or files, or "People in your organization" sharing links.
Press Run scan to check every SharePoint site.