What it works with
Module: PnP.PowerShell
Context: PowerShell 7.4+ · SharePoint Online · PnP.PowerShell
Compatibility: PowerShell 7.4+ is required by current PnP.PowerShell releases.
POWERSHELL / SHAREPOINT
FreeIntermediateRead-onlylow
Export SharePoint site collection administrators
Exports SharePoint site collection administrators across an explicit site scope while isolating sites that cannot be read.
Generated locally in your browser · Runs in your PowerShell environment · Review before running
What this PowerShell script does
Exports SharePoint site collection administrators across an explicit site scope while isolating sites that cannot be read.
Requirements
- Scope - Choose a single site, a CSV containing SiteUrl, or all tenant sites.
- SharePoint admin URL - Required only for all-tenant scope. Example: https://contoso-admin.sharepoint.com
- SharePoint site URL - Required for single-site scope.
- Site list CSV path - CSV must contain a SiteUrl column. Duplicate URLs are ignored.
- Entra app client ID - Your PnP app client ID. Leave empty only when a PnP default client ID is already configured.
- CSV output path - Use a new absolute Windows CSV path.
Environment
- Module: PnP.PowerShell
- Runtime: PowerShell 7.4+
- Authentication: Interactive PnP login with your own Entra app/client ID or configured default
- Permissions: SharePoint AllSites.Read delegated access plus signed-in-user access to each selected site; tenant scope also requires SharePoint Administrator / tenant-admin-site access.
- Risk: Low
Review before you run The generated script is read-only, but authentication and access requirements still apply in your tenant.
OPS / WORKSPACE
Ready to generate
Configure Export SharePoint site collection administrators in the Builder, review the generated PowerShell and run it in your own environment.
When to use this template
Exports administrators from one site, a CSV list of sites, or all tenant sites. Site-list input requires a SiteUrl column. Tenant-wide mode is intentionally serial and can be slow.
Important limitations
- Tenant scope is intentionally serial to avoid uncontrolled connection fan-out.
- IsPrimaryOrKnownOwner is populated only when a reliable known owner value is available from tenant-site metadata; otherwise it remains blank.
- A site access failure is recorded in the CSV and causes the final script status to report partial failure.
PowerShell and PnP requirements
Current PnP.PowerShell releases require PowerShell 7.4 or later. Interactive authentication requires your own Entra application/client ID, or a default client ID that you have configured for PnP.PowerShell. Opselith does not connect to SharePoint or run the script on your behalf.
Generate the script
- Open the template in the PowerShell Builder.
- Enter the requested URLs, client ID (when needed) and a new CSV output path.
- Generate the script, review its permissions and commands, then run it in your own PowerShell environment.
OPS / SCRIPT DETAILS
Script details
Exports SharePoint site collection administrators across an explicit site scope while isolating sites that cannot be read. Review these details before generating or running the script.
Permissions and impact
Permissions: AllSites.Read · SharePoint Administrator
Risk: Low
Execution impact: Read-only. The script reads site collection administrator membership for the selected sites and does not change site administrators.
Parameters
- Scope - Choose a single site, a CSV containing SiteUrl, or all tenant sites.
- SharePoint admin URL - Required only for all-tenant scope. Example: https://contoso-admin.sharepoint.com
- SharePoint site URL - Required for single-site scope.
- Site list CSV path - CSV must contain a SiteUrl column. Duplicate URLs are ignored.
- Entra app client ID - Your PnP app client ID. Leave empty only when a PnP default client ID is already configured.
- CSV output path - Use a new absolute Windows CSV path.
Output
Output: CSV report with SiteUrl, AdminDisplayName, AdminLoginName, AdminEmail, PrincipalType, IsPrimaryOrKnownOwner, CollectionStatus and Error.
This template is available in the free library and is generated locally in your browser.
Example use
Exports SharePoint site collection administrators across an explicit site scope while isolating sites that cannot be read.
Enter the required values in the Builder, review the generated script and confirm the output before running it.
Before you run: Use PowerShell 7.4+ with PnP.PowerShell and an interactive PnP app registration. For tenant scope, use a SharePoint Administrator account to enumerate sites. For single/list scope, the signed-in user must be able to read site collection administrators on every selected site. Choose a new output path.
Opselith quality checks
- Included in the current Opselith PowerShell quality suite
- Current PnP.PowerShell runtime and interactive-auth requirements documented
- Read-only behavior and minimum permissions documented
- Stable CSV column order and explicit zero-result behavior
- Review-before-run guidance provided
- No artificial pacing inside SharePoint enumeration loops
- Per-site failures are isolated and written to the result CSV before the script reports partial failure
Was this useful?One click. No email.