30-second answer

PowerShell
$appId = 'your Entra ID app registration id'
Connect-PnPOnline -Url https://contoso.sharepoint.com/sites/finance `
  -Interactive -ClientId $appId
Get-PnPSiteCollectionAdmin

Each result is a principal with Title, LoginName and PrincipalType. A principal can be a person, a Microsoft 365 group, or a security group.

What this proves

The accounts and groups that hold site collection administrator rights on this one site, as SharePoint itself records them. This is the strongest permission level a site has: an administrator can read, change and share everything in it.

What it does not prove

  • How many people that is. A group counts as one principal and may contain forty people, or one, or none. Counting principals is a lower bound on people, never an exact number.
  • Whether the people are active. A leaver whose account still exists is still returned.
  • Anything about other sites. The cmdlet answers for the connected site only.

PowerShell

PowerShell
Get-PnPSiteCollectionAdmin |
  Select-Object Title, LoginName, PrincipalType

PrincipalType distinguishes User from SecurityGroup. A group-connected team site typically shows its Microsoft 365 group owners entry here rather than named people.

Example output

Text
Title                     LoginName                                          PrincipalType
-----                     ---------                                          -------------
Ana Ferreira              i:0#.f|membership|ana@contoso.com                  User
Finance Owners            c:0o.c|federateddirectoryclaimprovider|8f2c...     SecurityGroup

Explanation

Two administrators in the output can mean two people, or one person and a group of unknown size. The LoginName prefix tells you which: claims that start with i:0#.f|membership| are individual accounts, and c:0o.c|federateddirectoryclaimprovider| is a Microsoft 365 group, with the group id after the last pipe. Expanding that group into people is a separate directory call, and until it is made, "at least one owner" is all the evidence supports.

Production considerations

  • Requires site collection administrator or SharePoint administrator rights on the target site. Without them the call fails with an authorization error rather than returning an empty list.
  • -ClientId is mandatory on every Connect-PnPOnline since PnP.PowerShell 2.99. See the authentication article.
  • Reading one site is one call. Walking a tenant of thousands of sites is thousands of connections; batch and throttle accordingly.
  • SPO-SITE-001: a site should have at least two owners
  • SPO-SITE-002: at least one administrator who is a person

References

Found something wrong? Suggest a correction. The article source is not public; the engine it cites is.

What this answer underwrites

The engine reads these Microsoft operations to collect evidence, so what is established here is what those collectors rest on.

  • ownerswho administers one site