30-second answer

Collection needs an Entra ID app registration and its client id. There is no default and there is no way around it, and the reason is a change in PnP.PowerShell rather than a choice made here.

Why --client-id is required

PnP.PowerShell removed its own multi-tenant application in 2.12.0. The release notes give the reason as the deprecation and shutdown of the PnP Management Shell.

A connection with no client id anywhere fails before it reaches the network:

Text
Please specify a valid client id for an Entra ID App Registration

Sources, both checked 2026-08-09, and verified against PnP.PowerShell 3.3.0: the PnP.PowerShell changelog and the default client id article.

Why the collector will not read it from the environment

The module itself accepts a default client id, configured by a cmdlet or by an environment variable. This collector does not use either, and there are two separate reasons.

Evidence has to say which identity observed it. A value read from an ambient environment variable is one nobody can name afterwards, and provenance that cannot be named is not provenance.

The read-only gate is a regex over every file. A regex cannot tell a mention from a call, so naming the configuring cmdlet in the collector would mean loosening the pattern that proves nothing in the tree mutates a tenant. Loosening it is how a real write slips in.

Device code sign in

For a host with no browser:

PowerShell
m365-governance collect sites \
  --client-id <id> \
  --tenant-url https://<tenant>-admin.sharepoint.com \
  --output ./evidence/ \
  --device-login

Which identity, and how much of it

The identity travels into every report:

Text
- Identity: application, scopes: Sites.Read.All

Two consequences follow, and both belong in the decision about what to grant.

Read only is the whole requirement. Nothing under the collector tree calls a mutating cmdlet, and CI proves it by parsing every file. An identity with write permissions grants more than the tool can use.

What the identity cannot see does not appear. A site absent from a sites collection is a site this identity could not enumerate, not a site that does not exist. Under-scoping produces a report that understates the estate while looking complete.