I have a request from management to hide the content of a specific sub-site from one of our SharePoint Online Admins. The Admin is not a Global Admin. In other words, is there a way to explicitly exclude an Admin from access to a specific site?
2
-
are you mean farm admin or site collection administrator ?– Mohamed El-Qassas MVP ♦Nov 17, 2016 at 14:36
-
Not a Global Administrator, a SharePoint Online Administrator, which is also a site collection administrator– Bob SetterboNov 17, 2016 at 14:37
Add a comment
|
3 Answers
If the user is Site collection admin on a site collection then you trying to hide a subsite under that site collection that is not possible, as Site collection admin has full control on that site.
But if it is different site collection then remove him from Site collection admins.
answered Nov 17, 2016 at 14:39
-
Thank you very much for the quick answer. If I remove this person from the "SharePoint Online Administrator" role and just assign him a "Site Collection Administrator" role for specific sites other than the site to be protected, would that work? Nov 17, 2016 at 14:46
-
it should work, as i said, as long as that person dont have the Site collection admin rights on that site collection, it will work– Waqas Sarwar MVP ♦Nov 17, 2016 at 14:47
Unfortunately, site collection administrator able to access anything in the site.
The only solution I can think of is to update the site collection administrators configuration within your Central Administration site so that they are populated with users that you do want to be able to access the site (ie: the business users who are the only ones who should have that access). If that is just one person, you can leave the secondary role blank, but you at least need to specify a primary administrator.
For more details check Site collection administrator from accessing a site
answered Nov 17, 2016 at 14:41
-
Thank you very much for the quick answer. If I remove this person from the "SharePoint Online Administrator" role and just assign him a "Site Collection Administrator" role for specific sites other than the site to be protected, would that work? Nov 17, 2016 at 14:46
-
yes , check the diff between them : A SharePoint Online administrator as Administrator of the SharePoint Online Administration Center can create and manage site collections, designate site collection administrators, determine tenant settings, and configure Business Connectivity Services and Secure Store, InfoPath Forms Services, Records Management, Search, and User Profiles. In Office 365, a Global administrator is also a SharePoint Online administrator. Nov 17, 2016 at 14:50
-
A Site collection administrator has administrator permissions to manage a site collection. A site collection can have several administrators, but only one primary administrator. The SharePoint Online services administrator should assign permissions to the primary site collection administrator when creating a site collection and can add more administrators for the site collection afterwards. Nov 17, 2016 at 14:50
-
for more details check support.office.com/en-us/article/… Nov 17, 2016 at 14:50
The short answer is yes, but it depends on what you mean by an admin. A site collection admin will have access to all the sub sites in that site collection. If you want to restrict them remove their access to the site collection role. A site owner, which as Full Control, will only have complete access to that particular site, all sites that inherit those permissions, and if the admin is added to a SharePoint group that gives them Full Control - they will have access to any site which that group is added to.
