The four surfaces
| Surface | Authoritative for | Notes |
|---|---|---|
| SharePoint admin center | Tenant sharing, site management, SAM, storage | The daily UI |
SPO Management Shell (Get-SPO*) |
Tenant + site-collection admin — sharing, quotas, RAC, site props | The tenant-admin scripting surface serv365 scans |
| PnP PowerShell | EVERYTHING inside a site — lists, items, permissions, provisioning | Community-built; reaches where SPO cmdlets can't |
| Microsoft Graph | Sites/drives/files as objects, app integration | Strong for file/data operations, thinner for site admin |
The app-only auth trade (the sharp bit)
Unattended automation uses app-only with a certificate (the platform pattern). The scope decision:
- SPO tenant-admin cmdlets (sharing, quotas, RAC — what serv365 reads) work under directory-level admin roles / Sites read scopes appropriate to reporting.
- PnP's full reach into site CONTENT (enumerate every item's unique permissions, provision structure) historically wants Sites.FullControl.All — a powerful, write-capable, all-sites grant. That is exactly the permission serv365 tested, proved gives the deep read, and then revoked as too broad for a read-only product's constitution (VERIFY_FIRST history). The lesson: the deepest SharePoint visibility carries the heaviest permission — grant it deliberately, scope it, prefer read where the API offers it.
The operating rule mirrors the other workloads: one owner per config area, read before write, export the truth on schedule (the scan) — and for SharePoint, weigh every FullControl grant as the crown-jewel-access decision it is.
What to watch (proofs)
- What an app can reach: the service principal's SharePoint/Graph permissions — Sites.Read vs Sites.FullControl is the difference between a reporting robot and a tenant-wide write key; audit which apps hold the latter.
- Tenant config truth:
Get-SPOTenant | fl— the sharing/security DNA, nightly scanned; drift here is posture drift. - The completeness gap: a setting visible in
Get-SPOTenant/PnP but not the admin-center UI — SharePoint, like Exchange, has cmdlet-only surface; the UI is a viewport. - Module currency: pinned SPO/PnP module versions — PnP moves fast; pin and read release notes before upgrading automation.