Least permission approach for New-PnPSite command

[eprach]

Hi team,

I am currently working on an application requiring creation of multiple SharePoint sites. Sites are created in bulk and when required, the application takes an available site and apply more configuration according to requirements.

To manage these 2 processes, I would like to use 2 app registrations in Entra ID for security purpose:

• 1 app registration for creating sites with "New-PnPSite" command
• 1 app registration for applying configurations when required by using sites.selected permissions.

If I try running the New-PnPSite command with these permissions, it fails:

If I try with these it works:

From my point of view and according to my requirements, "Sites.Manage.All" permission should not be required because it gives to high permissions for my app registration.

Any idea if it is by design or if it is a bug?