Is there a way to use Set-SPOUser to add a security group I created in Office 365 as a secondary site collection administrator?

I have the security group's Login Name which begins with "s-1-5-21-..." and I can use this login name to add the security group to an existing site group using Add-SPOUser without a problem.

But when I run the command:

Set-SPOUser -Site https://fakesite.sharepoint.com/sites/URL -LoginName s-1-5-21-112313...

I get the error:

Set-SPOUser : The user does not exist or is not unique.

  • this command is only for users, I dont think you can set groups as secondry site collection..But i think you can set the group permission level to Owner...use Set-SPOSiteGroup
    – Waqas Sarwar MVP
    Commented Sep 8, 2014 at 18:34
  • I can add security groups created in Office 365's Exchange Admin Center as secondary site collection administrators through the SharePoint Admin Center. And I can use Add-SPOUSer to add the same security group to any sharepoint group. The exchange security group is different from a sharepoint group. Commented Sep 9, 2014 at 19:03

4 Answers 4


You should be able to use this:

Set-SPOUser -Site "https://oursp.sharepoint.com/sites/sitecoll" -IsSiteCollectionAdmin $true -LoginName "c:0-.f|rolemanager|s-1-5-21-112313..."
  • This fails with the error "The user does not exist or is not unique". Tested with the default Company Administrator group (c:0-.f|rolemanager|s-1-1-11-11111111-111111-111111-1111). Commented Jan 9, 2020 at 10:09

User email address instead of name.

I have tried with following.

Set-SPOSite -Identity $NewSiteUrl -Owner "[email protected]"

But it sets both primary and secondary site collection admin as company administrator but it adds security group to site. Permission working as expected.

Not sure if secondary site collection administrator can be set using powershell in sharepoint online - office 365 site separately?


I use the following function in order to retrieve the LoginName of the O365 group:

# Ensure the user or group is registered in the site and return his login name
Function EnsureLoginName($userOrGroupName) {
    $web = Get-PnPWeb
    $userOrGroup = $web.EnsureUser($userOrGroupName)
    Return $userOrGroup.LoginName

Then I can set the group as site collection administrator as follows:

$loginName = EnsureLoginName "My Admin Group Name"
Set-SPOUser -site "https://oursp.sharepoint.com/sites/sitecoll" -LoginName $loginName -IsSiteCollectionAdmin $True

Notice that I use SharePoint PnP to retrieve the Web, so you would have to use Connect-PnPOnline first.


JUST incase anyone is still looking for a solution, for the SharePoint admin role and Company Administrator role you have to use the full claims token for loginName.


Remove-SPOUser -Site $site.url -LoginName "c:0t.c|tenant|c52dbe69-6384-4e71-b295-301136bdba47"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.