Can I use Set-SPOUser to set an O365 security group as a secondary site collection administrator?

Question

Is there a way to use Set-SPOUser to add a security group I created in Office 365 as a secondary site collection administrator?

I have the security group's Login Name which begins with "s-1-5-21-..." and I can use this login name to add the security group to an existing site group using Add-SPOUser without a problem.

But when I run the command:

Set-SPOUser -Site https://fakesite.sharepoint.com/sites/URL -LoginName s-1-5-21-112313...

I get the error:

Set-SPOUser : The user does not exist or is not unique.

Answer 1

You should be able to use this:

Set-SPOUser -Site "https://oursp.sharepoint.com/sites/sitecoll" -IsSiteCollectionAdmin $true -LoginName "c:0-.f|rolemanager|s-1-5-21-112313..."

Answer 2

User email address instead of name.

I have tried with following.

Set-SPOSite -Identity $NewSiteUrl -Owner "SPGroup@demo.onmicrosoft.com"

But it sets both primary and secondary site collection admin as company administrator but it adds security group to site. Permission working as expected.

Not sure if secondary site collection administrator can be set using powershell in sharepoint online - office 365 site separately?

Answer 3

I use the following function in order to retrieve the LoginName of the O365 group:

# Ensure the user or group is registered in the site and return his login name
Function EnsureLoginName($userOrGroupName) {
    $web = Get-PnPWeb
    $userOrGroup = $web.EnsureUser($userOrGroupName)
    $web.Context.Load($userOrGroup)
    $web.Context.ExecuteQuery()
    Return $userOrGroup.LoginName
}

Then I can set the group as site collection administrator as follows:

$loginName = EnsureLoginName "My Admin Group Name"
Set-SPOUser -site "https://oursp.sharepoint.com/sites/sitecoll" -LoginName $loginName -IsSiteCollectionAdmin $True

Notice that I use SharePoint PnP to retrieve the Web, so you would have to use Connect-PnPOnline first.

Answer 4

JUST incase anyone is still looking for a solution, for the SharePoint admin role and Company Administrator role you have to use the full claims token for loginName.

Example:

Remove-SPOUser -Site $site.url -LoginName "c:0t.c|tenant|c52dbe69-6384-4e71-b295-301136bdba47"