Manage-SiteCollectionAdmins.ps1

[System.Net.WebRequest]::DefaultWebProxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials 
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls11 -bor [System.Net.SecurityProtocolType]::Tls12   

Import-Module SharePointPnPPowerShellOnline

function Remove-SiteCollectionAdministrator
{
    [cmdletbinding()]
    param
    (
        [Parameter(Mandatory=$true,ValueFromPipeline=$true)][string]$SiteUrl,
        [Parameter(Mandatory=$true)][string[]]$PrincipalLogins
    )

    begin
    {
        $connection = Get-PnPConnection
    }
    process
    {
        $conn = Connect-PnPOnline `
                    -Url         $SiteUrl `
                    -ClientId    $connection.ClientId `
                    -Certificate $connection.Certificate `
                    -Tenant      $connection.Tenant `
                    -WarningAction SilentlyContinue `
                    -ReturnConnection

        Remove-PnPSiteCollectionAdmin -Owners $PrincipalLogins -Connection $conn 
    }
    end
    {
    }
}

function Get-SiteCollectionAdministrator
{
    [cmdletbinding()]
    param
    (
        [Parameter(Mandatory=$true,ValueFromPipeline=$true)][string]$SiteUrl
    )

    begin
    {
        $connection = Get-PnPConnection
    }
    process
    {
        $conn = Connect-PnPOnline `
                    -Url         $SiteUrl `
                    -ClientId    $connection.ClientId `
                    -Certificate $connection.Certificate `
                    -Tenant      $connection.Tenant `
                    -WarningAction SilentlyContinue `
                    -ReturnConnection

        Get-PnPSiteCollectionAdmin -Connection $conn | SELECT @{Name="SiteUrl"; E={$SiteUrl}}, *
    }
    end
    {
    }
}

function Add-SiteCollectionAdministrator
{
    [cmdletbinding()]
    param
    (
        [Parameter(Mandatory=$true,ValueFromPipeline=$true)][string]$SiteUrl,
        [Parameter(Mandatory=$true)][string[]]$PrincipalLogins
    )

    begin
    {
        $connection = Get-PnPConnection
    }
    process
    {
        $conn = Connect-PnPOnline `
                    -Url         $SiteUrl `
                    -ClientId    $connection.ClientId `
                    -Certificate $connection.Certificate `
                    -Tenant      $connection.Tenant `
                    -WarningAction SilentlyContinue `
                    -ReturnConnection

        Add-PnPSiteCollectionAdmin -Owners $PrincipalLogins -Connection $conn
    }
    end
    {
    }
}

$tenant              = "contoso"
$clientId            = "8a6b10a8-1234-1234-1234-9b8e49b6f6b7"
$CertificatePath     = "C:\_powershell\AADAppPrincipalCertificates\AppPrincipalCert.pfx"
$CertificatePassword = ConvertTo-SecureString -String "pass@word1" -AsPlainText -Force

$principals = @( 
    "c:0t.c|tenant|13465675-104a-4212-bb29-0b4edb69fdc2", # sharepoint admins security group
    "c:0t.c|tenant|724998d2-3c19-473d-ab73-6d286ebbbcd0", # Company Administrator
    "c:0t.c|tenant|f572b261-c3e5-4a60-ab50-67319ba24f64", # SharePoint Service Administrator
    "i:0#.f|membership|abbyg@contoso.com"                
)

# connect to the tenant
Connect-PnPOnline -Url "https://$tenant-admin.sharepoint.com" -ClientId $ClientId -CertificatePath $CertificatePath -CertificatePassword $CertificatePassword -Tenant "$tenant.onmicrosoft.com" -WarningAction SilentlyContinue

$siteCollectionUrls = Get-PnPTenantSite -Detailed -Connection $tenantConnection -IncludeOneDriveSites | ? Template -match "SPSPERS" | SELECT -ExpandProperty Url
    
$siteCollectionUrls | Get-SiteCollectionAdministrator | SELECT SiteUrl, LoginName, Title, Email, PrincipalType

$siteCollectionUrls | Remove-SiteCollectionAdministrator -PrincipalLogins $principals

$siteCollectionUrls | Add-SiteCollectionAdministrator -PrincipalLogins $principals