0

We're implementing a classification solution for modern sites (i.e. https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/modern-experience-site-classification). To be useful, we need to be able to report on this - i.e. to show the classification of every site in our tenancy. Is it possible to do this without first granting myself access to every site?

For example, we can retrieve a site classification like this:

Connect-PnPOnline "[Site URL]" -UseWebLogin
$site = Get-PnPSite
$classificationValue = Get-PnPProperty -ClientObject $site -Property Classification

But unless my tenant admin account specifically has access to that site, it will return a 403 Forbidden.

3
  • If any unauthorized user had access to site metadata, wouldn't that be a security risk? Commented Oct 13, 2019 at 4:36
  • I'd expect the tenancy-level SharePoint Administrator role to have access to site metadata. We can see most of it - e.g. if a sensitivity label is assigned to the site I can see that from the admin center. There's no security reason for tenant admins not to see all site classifications.
    – Jason Lee
    Commented Oct 14, 2019 at 16:28
  • It's the same analogy as onprem farm. By default farm admin doesn't have explicit permission to access to any of the sites. He can grant himself permissions but initially he doesn't have necessary permissions. Commented Oct 15, 2019 at 4:12

2 Answers 2

2

That won't be possible. You still need to be a site admin for the site to retrieve such information with PowerShell.

enter image description here

As a SP Admininstrator/Global Administrator you can go to the SharePoint Admin Center and Expport

1

I found a way. You can get this information from a hidden list named DO_NOT_DELETE_SPLIST_TENANTADMIN_AGGREGATED_SITECOLLECTIONS on the tenant admin site. You need to have the SharePoint Administrator role at the tenancy level, but you don't need access to each individual site.

Basic PowerShell example using the PnP module:

$tenantPrefix = "______"
Connect-PnPOnline -Url https://$tenantPrefix-admin.sharepoint.com -UseWebLogin
$list = Get-PnPList -Identity "DO_NOT_DELETE_SPLIST_TENANTADMIN_AGGREGATED_SITECOLLECTIONS"
$items = Get-PnPListItem -List $list
$report = @()
foreach($item in $items) {    
    $reportLine = [PSCustomObject][Ordered]@{
        Name = $item["Title"]
        Url = $item["SiteUrl"]        
        Classification = $item["Classification"]        
    }
    $report += $reportLine
}

$report | Format-Table

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.