pH7x SystemspH7x Systems®
ExpertiseKnowledgeToolsField GuideBlogAbout
← pH7x KnowledgeSharePoint

How to get SharePoint site collection administrators

Who administers this SharePoint site?

By João Livio·pH7x Knowledge

30-second answer

powershell
$appId = 'your Entra ID app registration id'
Connect-PnPOnline -Url https://contoso.sharepoint.com/sites/finance `
  -Interactive -ClientId $appId
Get-PnPSiteCollectionAdmin

Each result is a principal with Title, LoginName and PrincipalType. A principal can be a person, a Microsoft 365 group, or a security group.

What this proves

The accounts and groups that hold site collection administrator rights on this one site, as SharePoint itself records them. This is the strongest permission level a site has: an administrator can read, change and share everything in it.

What it does not prove

  • How many people that is. A group counts as one principal and may contain forty people, or one, or none. Counting principals is a lower bound on people, never an exact number.
  • Whether the people are active. A leaver whose account still exists is still returned.
  • Anything about other sites. The cmdlet answers for the connected site only.

PowerShell

powershell
Get-PnPSiteCollectionAdmin |
  Select-Object Title, LoginName, PrincipalType

PrincipalType distinguishes User from SecurityGroup. A group-connected team site typically shows its Microsoft 365 group owners entry here rather than named people.

Example output

text
Title                     LoginName                                          PrincipalType
-----                     ---------                                          -------------
Ana Ferreira              i:0#.f|membership|ana@contoso.com                  User
Finance Owners            c:0o.c|federateddirectoryclaimprovider|8f2c...     SecurityGroup

Explanation

Two administrators in the output can mean two people, or one person and a group of unknown size. The LoginName prefix tells you which: claims that

start with `i:0#.f membership ` are individual accounts, and

group id after the last pipe. Expanding that group into people is a separate directory call, and until it is made, "at least one owner" is all the evidence supports.

Production considerations

  • Requires site collection administrator or SharePoint administrator rights on the target site. Without them the call fails with an authorization error rather than returning an empty list.
  • -ClientId is mandatory on every Connect-PnPOnline since PnP.PowerShell 2.99. See the authentication article.
  • Reading one site is one call. Walking a tenant of thousands of sites is thousands of connections; batch and throttle accordingly.

References