Export SharePoint Access Request Settings

# ======================================================
# Configuration
# ======================================================

$TenantAdminURL = "https://contoso-admin.sharepoint.com"
$ClientID       = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
$ThumbPrint     = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
$Tenant         = "contoso.onmicrosoft.com"

# ======================================================
# Script Information 
# ======================================================
$RunDate = Get-Date -Format "yyyy-MM-dd HH\:mm\:ss"
$RunBy   = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name

# ---------- Output ----------

$CSVPath = "C:\Temp\AccessRequestData.csv"
$Results = @()
# ======================================================
# Connect to SharePoint Online (App-Only) 
# ======================================================

Connect-PnPOnline -Url $TenantAdminURL -ClientId $ClientID -Tenant $Tenant -Thumbprint $ThumbPrint

# Remove old CSV if present

if (Test-Path $CSVPath) {
    Remove-Item $CSVPath -Force
}

# ======================================================
# Get All Site Collections
# ======================================================

$SiteCollections = Get-PnPTenantSite | Where-Object {
    $_.Template -notin @(
        "SRCHCEN#0",
        "REDIRECTSITE#0",
        "SPSMSITEHOST#0",
        "APPCATALOG#0",
        "POINTPUBLISHINGHUB#0",
        "EDISC#0",
        "STS#-1"
    )
}

# ======================================================
# Function: Get Access Request Settings
# ======================================================

function Get-AccessRequestConfig {
    param($Web)

    Write-Host -ForegroundColor Yellow "Checking: $($Web.Url)"

    $AccessRequest       = ""
    $EmailOrGroup        = ""
    $AccessRequestConfig = ""

    if ($Web.HasUniqueRoleAssignments) {

        if (-not [string]::IsNullOrEmpty($Web.RequestAccessEmail)) {

            $AccessRequest       = "Enabled"
            $EmailOrGroup        = "Email"
            $AccessRequestConfig = $Web.RequestAccessEmail
        }
        elseif ($Web.UseAccessRequestDefault) {

            $AccessRequest = "Enabled"
            $EmailOrGroup  = "Default Owner Group"

            $OwnersGroup = Get-PnPGroup -AssociatedOwnerGroup -ErrorAction SilentlyContinue

            if ($null -ne $OwnersGroup) {
                $AccessRequestConfig = $OwnersGroup.Title
            }
        }
        else {
            $AccessRequest = "Disabled"
        }
    }
    else {
        $AccessRequest = "Inherited"
    }

    return [PSCustomObject]@{
        RunDate             = $RunDate
        RunBy               = $RunBy
        WebUrl              = $Web.Url
        AccessRequest       = $AccessRequest
        EmailOrGroup        = $EmailOrGroup
        AccessRequestConfig = $AccessRequestConfig
    }
}

# ======================================================
# Process Each Site Collection
# ======================================================

foreach ($Site in $SiteCollections) {

    Write-Host -ForegroundColor Cyan "Connecting to site: $($Site.Url)"

    try {

        Connect-PnPOnline `
            -Url $Site.Url `
            -ClientId $ClientID `
            -Tenant $Tenant `
            -Thumbprint $ThumbPrint `
            -ErrorAction Stop

        $Webs = Get-PnPSubWeb -IncludeRootWeb -Recurse -Includes `
            HasUniqueRoleAssignments, RequestAccessEmail, UseAccessRequestDefault `
            -ErrorAction Stop

        foreach ($Web in $Webs) {
            $Results += Get-AccessRequestConfig -Web $Web
        }
    }
    catch {
        Write-Host -ForegroundColor Red "Error processing $($Site.Url): $($_.Exception.Message)"
    }
}

# ======================================================
# Export Final Report 
# ======================================================

$Results | Export-Csv -Path $CSVPath -NoTypeInformation -Encoding UTF8

Write-Host -ForegroundColor Green "Access Request Report generated: $CSVPath"