Site Collection Administrators Sprawl
The question it answers: Who holds site collection administrator rights on which sites, including leavers, guests and broad groups?
Site collection administrators bypass every permission in a site and can grant access to anyone. Over the years admins, helpdesk staff, leavers and guests collect this right on hundreds of sites. This scan finds the holders that matter: guests, disabled accounts, broad claims and accounts that are admin almost everywhere.
At a glance
Section titled “At a glance”| Where in the app | SharePoint Online › SharePoint Operations & Legacy › Site Collection Admin Sprawl |
| Workload | SharePoint Online |
| Kind | Findings list · dashboard tile |
| Data | A scan: it runs only when someone presses Run scan (or calls the API’s scan action) and can take minutes. The last result is kept until the next scan. It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report. |
| Licence | No extra licence needed. |
| Report id (API and MCP) | sharepoint.operations.site-collection-admins |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Holder type | Category | Text |
| Admin / site | Subject | Link |
| Check | Setting | Text |
| Sites / admins | Value | Text |
| Finding | Finding | Text |
| Examples | Detail | Text |
| Date | When | Date |
| Count | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: No extra licence needed.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
Sites.FullControl.All | Office 365 SharePoint Online | Have full control of all site collections | certificate PnP |
User.Read.All | Microsoft Graph | Read all users’ full profiles | |
User-LifeCycleInfo.Read.All | Microsoft Graph | Read all users’ lifecycle information |
Data sources it reads
Get-PnPTenantSiteGet-PnPSiteCollectionAdmin (per site)
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/sharepoint.operations.site-collection-admins?size=100POST /ir-api/v1/reports/sharepoint.operations.site-collection-admins/scanAn AI assistant reads it with the MCP tool get_report and the id sharepoint.operations.site-collection-admins. The client needs the Run scan grant for SharePoint Online. See Using the API.