Operation unauthorized for any get-pnpsite or similar. (Global admin. App admin permissions consented. Using connect -interactive for each site already).

[mrmayconcr]

Running few PnP scripts for the last year but always hitting the same wall. When trying to get almost any information for in any site after connecting to admin URL and then connect to the own site, still return UNAUTHORIZED PERMISSION. What is making me use "set-pnptenantsite -identity $_ -owners {email} and the version for removing for each site. Which is multiplying a lot the required time for run each script as the environment has at least a hundred thousand of sites.

i've found multiple discussion and tried everything, including deleting and registering pnp management shell again, consenting admin to its permission again, connecting to each site manually, even tho, still returning unauthorized permission for every get-pnpsite or any get-pnp info.

What i'm missing?
Follow a bit of the code.

Config Variables

$TenantSiteURL = "https://TENANT-admin.sharepoint.com/"
$CSVFilePath = "C:\Temp\AllSitesSP.csv"
$AdminEmail = "{email}"

Connect to Tenant Admin Site

Connect-PnPOnline -Url $TenantSiteURL -Interactive

Import Existing CSV Data

$csvFile = Import-Csv $CSVFilePath

Iterate through Site Collections

foreach ($linha in $csvFile) {
Connect-PnPOnline $linha.Url -Interactive

set-pnptenantsite -Identity $linha.Url -Owners $AdminEmail #THIS IS THE WORKAROUND I'M USING, without it the script breaks in any get-pnp cmdlet.

try {
    # Get Associated Owner Group Information
    $Owner365group = Get-PnPGroup -AssociatedOwnerGroup #THIS IS WHERE THINGS START BREAKING, for any get-pnp cmdlet.

    code...
    code...
    
finally {
    Remove-PnPSiteCollectionAdmin -Owners $AdminEmail
}

}

[mrmayconcr]

up!

[mrmayconcr]

up

[Barbarur]

I think that's normal.

Being SharePoint Admin or Global Admin doesn't give you permissions to all the data directly.

The information in each site can only be accessed by users with access to the site. As Global/SharePoint Admin you need to grant yourself access to the site before being able to look at the information inside of the it.

The action of adding yourself as Site collection admin is recorded and can be audited if needed.

Not all organizations are happy with Global admin having unlimited access. So this additional step is required. The same reason why PIM exists.