2

I am migrating our local document storage to Office 365 SharePoint document libraries.

Part of what I've been asked to do is migrate documents owned by HR to a document library, but access to this library must be tightly controlled.

Ideally what they want is only the owner(s) of the site/library can grant access to it, and Office 365/SharePoint Admins can't access or grant access.

Is this possible, so far I haven't found a way?

Improve this question
1
  • Easiest is probably to tell them to password protect the document(s) if they can't trust admins. Most products that can be used for restricting access will some administrator have access to add/remove permissions to anyway.
    – Anders Aune
    Jul 27, 2016 at 14:01

2 Answers 2

Reset to default
1

I was faced with the same issue in a workplace that did not understand exactly how Microsoft products work and the answer is no, the administrator has higher power for a reason. What we have compromised on is to have a third party application that monitors accesses and creates daily/weekly reports so that every intrusion by administrators is justified before hand in that timeframe by some documentation. We did not get to the stage of identifying a tool that does this job, however there are such products for this purpose for other platforms.

Apparently some clueless people think their email inbox is not accessible by exchange administrators as well as the beloved shared drives. They do not seem to be concerned that every Exchange administrator can visit their inbox anytime he wants. Their paranoia is all on some busy sharepoint administrator/developer lurking around.

Improve this answer
2
  • This is as I expected, but due to the position of the people asking, I had no option but to pose the question. I did find an add on that will do it, but at several thousand a year, don't see it happening.
    – Tom
    Jul 27, 2016 at 6:40
  • I am aware that HR people might upload private and confidential details of other employees but the truth is that every single file they have (including the ones with the detailed salaries of everybody) is on display in their inbox or their shared drives, I know nobody that constantly password protects all files.
    – susan
    Jul 27, 2016 at 7:48
1

SharePoint Office 365 Admin has full control of every object. There is no way you can remove that.

One option is to log details of users who are viewing the list/library. You can add JSOM script to capture this information.

Also you can put a redirect logic in the pages so if the user is not part of say HR SPGroup then redirect to an access denied page.

Improve this answer
2
  • Thanks for the confirming what I expected. I'll offer the logging, but I doubt that'll satisfy them.
    – Tom
    Jul 27, 2016 at 6:41
  • @tom i have added one more option to my answer
    – Amal Hashim
    Jul 27, 2016 at 13:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.