30-second answer
Collection needs an Entra ID app registration and its client id. There is no default and there is no way around it, and the reason is a change in PnP.PowerShell rather than a choice made here.
Why --client-id is required
PnP.PowerShell removed its own multi-tenant application in 2.12.0. The release notes give the reason as the deprecation and shutdown of the PnP Management Shell.
A connection with no client id anywhere fails before it reaches the network:
Please specify a valid client id for an Entra ID App RegistrationSources, both checked 2026-08-09, and verified against PnP.PowerShell 3.3.0: the PnP.PowerShell changelog and the default client id article.
Why the collector will not read it from the environment
The module itself accepts a default client id, configured by a cmdlet or by an environment variable. This collector does not use either, and there are two separate reasons.
Evidence has to say which identity observed it. A value read from an ambient environment variable is one nobody can name afterwards, and provenance that cannot be named is not provenance.
The read-only gate is a regex over every file. A regex cannot tell a mention from a call, so naming the configuring cmdlet in the collector would mean loosening the pattern that proves nothing in the tree mutates a tenant. Loosening it is how a real write slips in.
Device code sign in
For a host with no browser:
m365-governance collect sites \
--client-id <id> \
--tenant-url https://<tenant>-admin.sharepoint.com \
--output ./evidence/ \
--device-loginWhich identity, and how much of it
The identity travels into every report:
- Identity: application, scopes: Sites.Read.AllTwo consequences follow, and both belong in the decision about what to grant.
Read only is the whole requirement. Nothing under the collector tree calls a mutating cmdlet, and CI proves it by parsing every file. An identity with write permissions grants more than the tool can use.
What the identity cannot see does not appear. A site absent from a sites
collection is a site this identity could not enumerate, not a site that does
not exist. Under-scoping produces a report that understates the estate while
looking complete.