What it works with
Module: PnP.PowerShell
Context: PowerShell 7.4+ · SharePoint Online · PnP.PowerShell
Compatibility: PowerShell 7.4+ is required by current PnP.PowerShell releases.
POWERSHELL / SHAREPOINT
FreeIntermediateRead-onlyLow
Find SharePoint sites with ownership gaps
Finds SharePoint sites whose tenant owner field or site collection administrator coverage needs review without claiming that every flagged site is truly ownerless.
Generated locally in your browser · Runs in your PowerShell environment · Review before running
What this PowerShell script does
Finds SharePoint sites whose tenant owner field or site collection administrator coverage needs review without claiming that every flagged site is truly ownerless.
Requirements
- SharePoint admin URL - SharePoint tenant administration URL, for example https://contoso-admin.sharepoint.com.
- Entra app client ID - Your PnP app client ID. Leave empty only when a PnP default client ID is already configured.
- CSV output path - Use a new absolute Windows CSV path.
Environment
- Module: PnP.PowerShell
- Runtime: 7.4+
- Authentication: Interactive PnP login with your own Entra app/client ID or configured default
- Permissions: AllSites.Read · SharePoint Administrator
- Risk: Low
Review before you runThe generated script is read-only, but authentication and access requirements still apply in your tenant.
OPS / WORKSPACE
Ready to generate
Configure Find SharePoint sites with ownership gaps in the Builder, review the generated PowerShell and run it in your own environment.
When to use this template
Use this report to identify SharePoint sites that deserve an ownership review. It deliberately avoids claiming that a site is ownerless solely because one metadata field is empty.
Important limitations
- A flagged site is a review candidate, not proof that the site has no functional owner.
- Microsoft 365 group owners are not queried; group-connected sites can have ownership represented outside the tenant Owner field.
- Direct item/list permission owners are outside this report.
PowerShell and PnP requirements
Current PnP.PowerShell releases require PowerShell 7.4 or later. Interactive authentication requires your own Entra application/client ID, or a default client ID configured for PnP.PowerShell. Opselith does not connect to SharePoint or execute the script on your behalf.
Generate the script
- Open this template in the PowerShell Builder.
- Enter the required scope, authentication and output values.
- Generate the script, review its permissions and commands, then run it in your own PowerShell environment.
OPS / SCRIPT DETAILS
Script details
Finds SharePoint sites whose tenant owner field or site collection administrator coverage needs review without claiming that every flagged site is truly ownerless. Review these details before generating or running the script.
Permissions and impact
Permissions: AllSites.Read · SharePoint Administrator
Risk: Low
Execution impact: Read-only. Reads tenant site owner metadata and site collection administrators. It does not add owners/admins or change permissions.
Parameters
- SharePoint admin URL - SharePoint tenant administration URL, for example https://contoso-admin.sharepoint.com.
- Entra app client ID - Your PnP app client ID. Leave empty only when a PnP default client ID is already configured.
- CSV output path - Use a new absolute Windows CSV path.
Output
Output: CSV report with SiteUrl, Title, Template, GroupConnected, OwnerField, SiteCollectionAdminCount, AdminSummary, GapSignal, ReviewReason, Status and Error.
This template is available in the free library and is generated locally in your browser.
Example use
Finds SharePoint sites whose tenant owner field or site collection administrator coverage needs review without claiming that every flagged site is truly ownerless.
Enter the required values in the Builder, review the generated script and confirm the output before running it.
Before you run: Use PowerShell 7.4+ with PnP.PowerShell. Sign in to the SharePoint tenant administration site with a SharePoint Administrator account. Review findings as signals that need administrator validation, not as a universal ownerless-site verdict.
Opselith quality checks
- Included in the current Opselith PowerShell quality suite
- Conservative ownership signals instead of a simplistic ownerless claim
- Microsoft 365 group owners are not silently inferred
- Site-admin read failures remain UNKNOWN rather than false gaps
- Only review candidates are exported
Was this useful?One click. No email.