All scripts
Governance 290

Get-SharePointSiteCollectionAdminReport

Lists every user who is a site collection administrator on any site in the tenant, and how many sites they have that role on, to catch overly broad admin assignments.

Get-SharePointSiteCollectionAdminReport.ps1
<#
.SYNOPSIS
    Reports site collection administrators across the whole tenant.

.DESCRIPTION
    Walks every site in the tenant, collects site collection
    administrators, and aggregates by user so anyone with an unusually
    broad number of admin assignments stands out.

.EXAMPLE
    .\Get-SharePointSiteCollectionAdminReport.ps1

.NOTES
    Requires PnP.PowerShell connected to the SharePoint admin site.

.AUTHOR
    Shehryar Hassan
#>

$sites = Get-PnPTenantSite
$adminCounts = @{}

foreach ($site in $sites) {
    $admins = Get-PnPSiteCollectionAdmin -Connection (Connect-PnPOnline -Url $site.Url -ReturnConnection -Interactive)
    foreach ($admin in $admins) {
        $adminCounts[$admin.Email] = ($adminCounts[$admin.Email] ?? 0) + 1
    }
}

$adminCounts.GetEnumerator() | Sort-Object Value -Descending |
    Select-Object @{N="Admin";E={$_.Key}}, @{N="SiteCount";E={$_.Value}} |
    Format-Table -AutoSize

Read it before you run it, and test in a safe tenant first.