Understanding implications of "you need to be a SharePoint Administrator"

[Magnus-K-work]

Hi!

In the documentation of Recycling Site Collections, the banner under the heading states that "You need to be either a SharePoint Administrator or Global Administrator to use these methods". What does this imply for my code when setting up authentication provider? Must I use a On-Behalf-Of authentication flow or can I use an authenticating with app registration and certificate to enable my application to call RecycleSiteCollectionAsync like this?

var certAuthProvider = new X509CertificateAuthenticationProvider(
    clientId: <ClientId>),
    tenantId: <TenantId>),
    certificate: <certificate>);

using (var context = await _pnpContextFactory.CreateAsync(new Uri(RootSiteUrl), certAuthProvider))
{
    var siteExists = await context.GetSiteCollectionManager().SiteExistsAsync(siteToDeleteUri);

    if (siteExists)
    {
        await context.GetSiteCollectionManager()
            .RecycleSiteCollectionAsync(siteToDeleteUri);
    }
}

[jansenbe]

@Magnus-K-work : it has nothing to do with how you configure auth, in this case the account used to recycle the site collection must have the proper permissions as not every user can delete a site collection

[Magnus-K-work]

Thank you for your answer., but I still can't get my code to work.

My question can be simplified as:
Must a user account be used (On-behalf-of auth) to recycle site collections, or can this be done with a app registration (login with client id and a certificate)?

[jansenbe]

@Magnus-K-work : all the test cases that create site collections using application permissions also call the DeleteSiteCollectionAsync method which under the covers calls the RecycleSiteCollectionAsync. Doing some testing with application permissions showed that for group connected sites (modern team site) this failed, for non group connected sites (e.g. communication site) this works. We're using the same logic as the one applied in SharePoint Admin center, if you want to recycle group connected site collections maybe using the graph approach can help here: https://learn.microsoft.com/en-us/graph/api/group-delete?view=graph-rest-1.0&tabs=http. You can experiment calling this API from PnP Core SDK via our options to call other APIs: https://pnp.github.io/pnpcore/using-the-sdk/basics-customapirequests.html#making-a-custom-microsoft-graph-request

[Magnus-K-work]

@jansenbe Thanks for your answer, I marked it as the answer.