List All SharePoint Sites in a Microsoft 365 Tenant

Knowing exactly which SharePoint sites exist in your tenant is the foundation of any governance, storage optimization, or security review. Over time, tenants accumulate sites from Teams creation, Project provisioning, one-off Communication sites, and legacy migrations — most admins are surprised by how many sites actually exist.

Common scenarios where you need a full site inventory:

• Storage planning — identifying which sites consume the most SharePoint quota
• Stale site cleanup — finding sites that haven't been touched in 12+ months
• Security audits — reviewing external sharing, permissions, and sensitive content per site
• Migration prep — baselining before a tenant-to-tenant move or restructuring
• Compliance reporting — producing an authoritative list for auditors

This recipe produces a CSV of every site with its display name, web URL, and site ID — the starting point for every downstream governance task.

• A complete list of all SharePoint site collections in the tenant
• CSV export (sharepoint_sites_list.csv) with Display Name, Web URL, and Site ID columns
• A count of total active sites for capacity and license planning
• A reusable baseline you can feed into follow-up recipes (usage reports, sharing audits, archival)

Things to watch for

• Search-based enumeration has limits. GET /sites?search=* returns sites indexed by SharePoint search and excludes the root site and some system sites. For a truly exhaustive list (including personal OneDrive sites), use GET /sites/getAllSites (beta) or SharePoint PnP PowerShell's Get-PnPTenantSite.
• Large tenants require pagination. Results are paged at ~200 sites. Always follow @odata.nextLink until it is absent.
• OneDrive personal sites are technically site collections but are usually filtered out of governance inventories. If you need them, include isPersonalSite filtering.
• Read-only operation. This recipe only enumerates — it does not modify any site. Safe to run in production at any time.
• Data sensitivity. Site URLs can reveal project names, M&A codenames, and confidential initiatives. Treat the exported CSV as confidential.